Searching a field over a specifc date

[kamronnikkhah]

Hi,

I'm creating a query in splunk and need to search a field over a specific date.

Field example; lastLogonTimestamp=01:00.21 PM, Sat 04/29/2023.

So I want to search for anything where that field is 2023 or over as my query will be running in 2024 and so on.

Any advice would be appricated.

Many Thanks

[kamronnikkhah]

I cant use the main timestamp field as this shows different results, it needs to be the lastLogonTimestamp field making it bit more tricky.

If I can parse out the field from the event will it be the case of doing a where command anything greater than 2023?

[PickleRick · Accepted solution]

The trick here is that such search will unfrotunately most probably not be very effective.

In some specific cases (if your key/value pair was separated by a minor breaker and you had your year at the beginning of the field value) you could use TERM search. But in general you'd have to parse out the value of this field from every single event. If you're OK with year-sized resolution, you can simply filter with - for example

| where like(LastLogonTime,"%2023%") OR like(LastLogonTime,"%2024%")

[kamronnikkhah]

Thanks. This works as an alternative, much appreciated.

[PickleRick]

As I said before, you probably can use strptime on that field to parse out the timestamp but in this particular case I think it would be even worse-performing.

[PickleRick]

I'll assume that you mean "2023 or later".

The main question is if you can just use the "main" event's timestamp (the _time field). It's the most efficient way to filter events so if you can rely on this one - use it. Just choose time range with time picker or specify earliest/latest parameters in your search.

Otherwise you have to parse out the field from the event, parse the timestamp from it (most probably using the strptime() function), then compare this value to a pre-set value. Remember that you still have to set some general search time limits (for the _time field).

This _might_ (but it would need further analysis) actually be the case when addition of indexed field could be benefitial.