Splunk Search

How to leave date (in a field) is before today?

KH
Engager

I'm extremely new to Splunk and finding learning SPL very frustrating.

I'm trying to look for windows log on events/ attempted log ons by leavers accounts after their last working day. How do i say where a specific field (the last working day) is before todays date. 

The last working day field which I'm pulling from a separate index is in the following format "2020-02-28 00:00:00.0"

 

 

Labels (2)
0 Karma

KH
Engager

thank you! 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You need to parse the last working day into an epoch time, then compare it to the epoch time for the start of the current day.

| where strptime(last_working_day_field,"%Y-%m-%d %H:%M:%S") < relative_time(now(),"@d")
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...