Splunk Search

Is there anyway in Splunk to search in Date field?

abi2023
Path Finder

my Spl is 
my base search | transaction ID | stats count values(Date) as Date value(field1) as field1 by ID

I get result 

Date                 field1               ID
02/20/23.         CCC              10
02/10/23
02/05/23

02/10/23.         CC                  08
02/05/23

02/01/23           C                     01

 

Is there anyway in Splunk to search in Date field?

I am try to display result without Date 02/20/23

I try search Date!="02/20/23" and where Date="02/20/23" can anyone help is do able in splunk?

Labels (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

my base search 
| transaction ID 
| stats count values(Date) as Date value(field1) as field1 by ID
| where isnull(mvfind(Date,"02\/20\/23"))

View solution in original post

somesoni2
Revered Legend

Give this a try

my base search 
| transaction ID 
| stats count values(Date) as Date value(field1) as field1 by ID
| where isnull(mvfind(Date,"02\/20\/23"))

abi2023
Path Finder

for the same spl but If I only want latest result show. how can I modify the search? assuming I don't know last event date.  

0 Karma

somesoni2
Revered Legend

Since the mvfind function only support one field reference, it would be difficult to do filter based on dynamic latest Date value. Try this alternate implementation

my base search 
| eventstats latest(Date) as latestDate
| eval shouldInclude=if(Date=latestDate,1,0)
| transaction ID 
| stats count values(Date) as Date value(field1) as field1 max(shouldInclude) as shouldInclude by ID
| where shouldInclude=1

 

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...