How to get eval command to display results with X days before current date?

[neerajs_81]

Hi All, i have a field "last_seen" which shows date in the below format .    My requirement is to compare today's date against this last_seen date and show only those events which is 3 days before today's date

last_seen

2022-12-15T19:46:55Z

2022-12-14T19:46:55Z

2022-12-11T19:46:55Z

I thought of calculating first a field that shows me the date   3 days before this last_seen value and then further doing a |where condition to show me the results.  I tried the below calculation  but deltaDays is  coming out empty as splunk shows it blank . So the formula of now()-last_seen isn't working.    Reference: https://community.splunk.com/t5/Splunk-Search/Display-events-when-current-date-is-gt-30-days-from-ex...

| eval deltaDays = (now() - last_seen)/86400 | where deltaDays >=3
| table last_seen deltaDays 

Expected results ( given todays date is Dec 16).  Show results from 3 days before

last_seen

2022-12-11T19:46:55Z

[Manasa_401 · Accepted solution]

Hi @neerajs_81 

Try converting the last_seen into epoch format
|eval e_last_seen = strptime(last_seen,"%Y-%m-%dT%H:%M:%SZ")

Later you can perform the calculations as you did 

| eval deltaDays = (now() - e_last_seen)/86400 | where deltaDays >=3
| table last_seen deltaDays

If this helps karma would be appreciated.

Thanks
Manasa

[neerajs_81]

THANK you

[gcusello]

Hi @neerajs_81,

your approach is correct.

What's your question?

Ciao.

Giuseppe

[neerajs_81]

Thank you for checking.  I was making a mistake in the strptime() command.  Had the time format mentioned incorrectly there.   
Manasa's response worked