Search to find where one date field starts before another

[vishalduttauk]

Hi there,

I have a search where I want to see where one date field is the same or starts before another but my search results only shows me events where both dates are the same, can you help?

I am trying to find events which contains an end date that is before the created date.

The data isn't create so a typical date entry would be 12112022

index=UAT sourcetype="Test_Txt_data"
| eval end_date_epoch = strptime(end_date,"%d%m%Y")
| eval created_date_epoch = strptime(created_date,"%d%m%Y")
| where end_date_epoch <= created_date_epoch
| eval end_date = strftime(end_date_epoch, "%d/%m/%Y"),
created_date = strftime(created_date_epoch, "%d/%m/%Y")
| table proposal, created_date, end_date

[rrovers · Accepted solution]

I don't know what's exactly in your index but this works:

|makeresults 
|eval end_date="10112022"
| eval created_date="12112022"
| eval end_date_epoch = strptime(end_date,"%d%m%Y")
| eval created_date_epoch = strptime(created_date,"%d%m%Y")
| where end_date_epoch <= created_date_epoch
| eval end_date = strftime(end_date_epoch, "%d/%m/%Y")
| eval created_date = strftime(created_date_epoch, "%d/%m/%Y")
| table proposal, created_date, end_date

If this doesn't solve your problem please give some more information

[vishalduttauk]

Thanks @rrovers that has worked a treat 🙂