Splunk Search

How to use _time in where clause with like

ankurborah
Path Finder

I have to use a date filed fields.updated to filter records the I have to filter based on matching Year-Month as below.

index=Jira_ticket_idx*|rename fields.updated as NewDate|eval NewDate=strptime(strftime(strptime(NewDate, "%Y-%m-%dT%H:%M:%S"),"%Y-%m-%d"),"%Y-%m-%d")|eval _time=NewDate|where like(_time,"%2017-08%")|timechart count

Need experts help.

Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The strptime function returns an epoch (integer) timestamp. This means the like function will fail because one can't compare an integer to a string. Try this query.

index=Jira_ticket_idx*|rename fields.updated as NewDate|where like(NewDate, "%2017-08%") | eval _time=strptime(NewDate, "%Y-%m-%dT%H:%M:%S") | timechart count
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The strptime function returns an epoch (integer) timestamp. This means the like function will fail because one can't compare an integer to a string. Try this query.

index=Jira_ticket_idx*|rename fields.updated as NewDate|where like(NewDate, "%2017-08%") | eval _time=strptime(NewDate, "%Y-%m-%dT%H:%M:%S") | timechart count
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...