Splunk Search

Need to eval date range instead of relative time from custom time field.

matt4321
Explorer

I am currently using this method to use date from custom field for relative time frames which only gives me 3 months.

| eval NewTime=strptime(ProjCreatedDate,"%Y-%m-%d %H:%M:%S")
| eval _time=NewTime
| where _time>=relative_time(now(),"-3mon") AND _time

I need to get instead of relative time Last 3 months I need a time range.. From 1/1/2017 to 5/21/2017.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Can you explain your requirement more, possibly with an example of what you currently get and what you expect?

0 Karma

matt4321
Explorer

Yes sorry for some reason this posted with my bottom question not in there. I need to get instead of relative time Last 3 months I need a time range.. From 1/1/2017 to 5/21/2017.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

If you're trying to compare against the specific/static dates, do like this

your base search | eval _time=strptime(ProjCreatedDate,"%Y-%m-%d %H:%M:%S")
| where _time>=strptime("1/1/2017","%m/%d/%Y") AND _time<=strptime("5/21/2017","%m/%d/%Y") 

matt4321
Explorer

This worked perfect Thank you very much!! Trying to change this to the answer now.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi matt4321,
try something like this:

your_search
| eval NewTime=strptime(ProjCreatedDate,"%Y-%m-%d %H:%M:%S")
| where NewTime>=relative_time(now(),"-3mon") 

I didn't understood the second condition "AND _time"

Bye.
giuseppe

0 Karma

matt4321
Explorer

Awesome I was wondering about that as well.. I will remove it and see how it goes.

Do you know about the updated comment?
"I need to get instead of relative time Last 3 months I need a time range.. From 1/1/2017 to 5/21/2017."

Any help would be appreciated.

0 Karma

gcusello
SplunkTrust
SplunkTrust

as suggested by @somesoni2 modify the where condition with

| where _time>=strptime("1/1/2017","%m/%d/%Y") AND _time<=strptime("5/21/2017","%m/%d/%Y") 

Bye.
Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

If this answer satisfies your question, please accept or upvote it.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...