Search earliest and latest within a field

[mrdeterville]

Hi All;

I have list of events, which includes a field called reported_date, format is yyyy-mm-dd.

I'm trying to create a search that looks for reported_date within the last 15 months of current day. 

Is it possible to do an earliest and latest search within a specific field?

Note: _time does not align with the reported_date.

Any assistance would be greatly appreciated!

TIA

[yuanliu]

In addition to what @ITWhisperer says, what is the physical significance of _time currently in your data?  Is there any reason why your ingestion should NOT use reported_date instead of whatever is used in current data?  That will make your requirement so much simpler to fulfill. (If this is a viable alternative, there could be other benefit, too.)

This said, Splunk can always search records where reported_date falls within the last 15 months.  Here, I will illustrate with the following caveat: reported_date is always earlier than or equal to _time.  There can be other strategies to search if this condition is not true but unless that is a problem in your case, the following method is simpler.

<your search criteria> earliest=-15mon
| where relative_time(now(), "-15mon") < strptime(reported_date, "%F")
``` "%F" -> "%Y-%m-%d" ```

[ITWhisperer · Accepted solution]

Short answer is no. Events are timestamped by the _time field and earliest and latest applies to this field, not to some other field in the event. You would have to apply a time period (earliest and latest) to your search to cover enough of your events to find events where reported_date is between the times you are interested in.