Splunk Search

How to search based on the the time field from the event?

New Member

Hi Team,

I am having field called expirationdatetime in my event and its format is 2019-06-21T06:08:40.220082Z. My requirement is to get the count of users whose request going to expire in next 2 days.

Built a search - index="XXX" sourcetype="RRR" expirationdatetime=now+2d

When i hit the above expression, i didnt get any events.

Help on this

0 Karma

Super Champion

Hi @bhuvanabala,

This should do the trick :

index="XXX" sourcetype="RRR" 
|eval expirationdatetime=strptime(expirationdatetime,"%Y-%m-%dT%H:%M:%S.%Q") 
|where expirationdatetime < relative_time(now(), "-+2d")

Let me know if it helps.


0 Karma



Does this help?

| makeresults 
| eval time_given="2019-06-20T06:08:40.220082Z" 
| eval time_given_in_epoch_format=strptime(time_given,"%Y-%m-%dT%H:%M:%S.%Q") 
| eval time_2_days_from_now=relative_time(now(),"+2d") 
| eval time_2_days_from_now_human_readable=strftime(time_2_days_from_now,"%Y-%m-%d %H:%M:%S.%Q")
| eval breach=if(time_given_in_epoch_format>=time_2_days_from_now,1,0)
|table breach
0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...