Splunk Search

Howto use _time to compare with field with time

krusovice
Path Finder

Hello,

I've a field with date/time in it. The field name is system_created_on=2019-04-26 09:38:24.

I have a time picker and I would like to use the date selected to compare with a field with date/time. For example, when user select 4/26/2019, I need to have the query to match with"2019-04-26" from system_created_on field. How can I achieve this?

Thanks.

1 Solution

woodcock
Esteemed Legend

Like this:

index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo eatliest=0 latest=now
| eval system_created_on=strptime(system_created_on, "%Y-%m-%d %H:%M:%S")
| addinfo
| where (system_created_on >= info_min_time AND system_created_on <= info_max_time)
| fieldformat system_created_on=strftime(system_created_on, "%Y-%m-%d %H:%M:%S")

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo eatliest=0 latest=now
| eval system_created_on=strptime(system_created_on, "%Y-%m-%d %H:%M:%S")
| addinfo
| where (system_created_on >= info_min_time AND system_created_on <= info_max_time)
| fieldformat system_created_on=strftime(system_created_on, "%Y-%m-%d %H:%M:%S")
0 Karma

krusovice
Path Finder

Wow thanks, it works!

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...