Hi there,
I have a search where I want to see where one date field is the same or starts before another but my search results only shows me events where both dates are the same, can you help?
I am trying to find events which contains an end date that is before the created date.
The data isn't create so a typical date entry would be 12112022
index=UAT sourcetype="Test_Txt_data"
| eval end_date_epoch = strptime(end_date,"%d%m%Y")
| eval created_date_epoch = strptime(created_date,"%d%m%Y")
| where end_date_epoch <= created_date_epoch
| eval end_date = strftime(end_date_epoch, "%d/%m/%Y"),
created_date = strftime(created_date_epoch, "%d/%m/%Y")
| table proposal, created_date, end_date
I don't know what's exactly in your index but this works:
|makeresults
|eval end_date="10112022"
| eval created_date="12112022"
| eval end_date_epoch = strptime(end_date,"%d%m%Y")
| eval created_date_epoch = strptime(created_date,"%d%m%Y")
| where end_date_epoch <= created_date_epoch
| eval end_date = strftime(end_date_epoch, "%d/%m/%Y")
| eval created_date = strftime(created_date_epoch, "%d/%m/%Y")
| table proposal, created_date, end_date
If this doesn't solve your problem please give some more information
I don't know what's exactly in your index but this works:
|makeresults
|eval end_date="10112022"
| eval created_date="12112022"
| eval end_date_epoch = strptime(end_date,"%d%m%Y")
| eval created_date_epoch = strptime(created_date,"%d%m%Y")
| where end_date_epoch <= created_date_epoch
| eval end_date = strftime(end_date_epoch, "%d/%m/%Y")
| eval created_date = strftime(created_date_epoch, "%d/%m/%Y")
| table proposal, created_date, end_date
If this doesn't solve your problem please give some more information