Splunk Search

## How to get eval command to display results with X days before current date?

Builder

Hi All, i have a field "last_seen" which shows date in the below format .    My requirement is to compare today's date against this last_seen date and show only those events which is 3 days before today's date

 last_seen 2022-12-15T19:46:55Z 2022-12-14T19:46:55Z 2022-12-11T19:46:55Z

I thought of calculating first a field that shows me the date   3 days before this last_seen value and then further doing a |where condition to show me the results.  I tried the below calculation  but deltaDays is  coming out empty as splunk shows it blank . So the formula of now()-last_seen isn't working.    Reference: https://community.splunk.com/t5/Splunk-Search/Display-events-when-current-date-is-gt-30-days-from-ex...

``````| eval deltaDays = (now() - last_seen)/86400 | where deltaDays >=3
| table last_seen deltaDays ``````

Expected results ( given todays date is Dec 16).  Show results from 3 days before

 last_seen 2022-12-11T19:46:55Z

Labels (1)
• ### eval

Tags (1)
1 Solution
Communicator

Hi @neerajs_81

Try converting the last_seen into epoch format
|eval e_last_seen = strptime(last_seen,"%Y-%m-%dT%H:%M:%SZ")

Later you can perform the calculations as you did

| eval deltaDays = (now() - e_last_seen)/86400 | where deltaDays >=3
| table last_seen deltaDays

If this helps karma would be appreciated.

Thanks
Manasa

Communicator

Hi @neerajs_81

Try converting the last_seen into epoch format
|eval e_last_seen = strptime(last_seen,"%Y-%m-%dT%H:%M:%SZ")

Later you can perform the calculations as you did

| eval deltaDays = (now() - e_last_seen)/86400 | where deltaDays >=3
| table last_seen deltaDays

If this helps karma would be appreciated.

Thanks
Manasa

Builder

THANK you

Esteemed Legend

Hi @neerajs_81,

your approach is correct.

Ciao.

Giuseppe

Builder

Thank you for checking.  I was making a mistake in the strptime() command.  Had the time format mentioned incorrectly there.
Manasa's response worked

Get Updates on the Splunk Community!

#### Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

#### Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

#### Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...