Splunk Search

How to search based on the the time field from the event?

bhuvanabala
New Member

Hi Team,

I am having field called expirationdatetime in my event and its format is 2019-06-21T06:08:40.220082Z. My requirement is to get the count of users whose request going to expire in next 2 days.

Built a search - index="XXX" sourcetype="RRR" expirationdatetime=now+2d

When i hit the above expression, i didnt get any events.

Help on this

0 Karma

DavidHourani
Super Champion

Hi @bhuvanabala,

This should do the trick :

index="XXX" sourcetype="RRR" 
|eval expirationdatetime=strptime(expirationdatetime,"%Y-%m-%dT%H:%M:%S.%Q") 
|where expirationdatetime < relative_time(now(), "-+2d")

Let me know if it helps.

Cheers,
David

0 Karma

pramit46
Contributor

@bhuvanabala,

Does this help?

| makeresults 
| eval time_given="2019-06-20T06:08:40.220082Z" 
| eval time_given_in_epoch_format=strptime(time_given,"%Y-%m-%dT%H:%M:%S.%Q") 
| eval time_2_days_from_now=relative_time(now(),"+2d") 
| eval time_2_days_from_now_human_readable=strftime(time_2_days_from_now,"%Y-%m-%d %H:%M:%S.%Q")
| eval breach=if(time_given_in_epoch_format>=time_2_days_from_now,1,0)
|table breach
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!