Splunk Search

How to use _time in where clause with like

ankurborah
Path Finder

I have to use a date filed fields.updated to filter records the I have to filter based on matching Year-Month as below.

index=Jira_ticket_idx*|rename fields.updated as NewDate|eval NewDate=strptime(strftime(strptime(NewDate, "%Y-%m-%dT%H:%M:%S"),"%Y-%m-%d"),"%Y-%m-%d")|eval _time=NewDate|where like(_time,"%2017-08%")|timechart count

Need experts help.

Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The strptime function returns an epoch (integer) timestamp. This means the like function will fail because one can't compare an integer to a string. Try this query.

index=Jira_ticket_idx*|rename fields.updated as NewDate|where like(NewDate, "%2017-08%") | eval _time=strptime(NewDate, "%Y-%m-%dT%H:%M:%S") | timechart count
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The strptime function returns an epoch (integer) timestamp. This means the like function will fail because one can't compare an integer to a string. Try this query.

index=Jira_ticket_idx*|rename fields.updated as NewDate|where like(NewDate, "%2017-08%") | eval _time=strptime(NewDate, "%Y-%m-%dT%H:%M:%S") | timechart count
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...