Splunk Search

Splunk Date/Time comparison using _time generated through timechart for a Span of 1 Month

promukh
Path Finder

Hello Experts,

I  am having a search as below 

 

 

|search | eval _time=new_t | timechart span=1mon sum(alloc) as used | streamstats sum(used) as "Total" | predict "Total" as "Projected" future_timespan=8

 

 

 

Output from the search is as below

_timeUsedTotalProjectedlower95
2019-0911<some numbers><some numbers>
2020-0323<some numbers><some numbers>
2020-0447<some numbers><some numbers>
2020-05411<some numbers><some numbers>
2020-09516<some numbers><some numbers>
2020-10  <some numbers><some numbers>
2020-11  <some numbers><some numbers>
2020-12  <some numbers><some numbers>
2021-01  <some numbers><some numbers>

 

How can i compare the "_time" field with current "month-year"  and display only those rows greater than the current Year-Month.

| search _time>strftime(now(),"%Y-%m-%d")

 

 

Any hep will be appreciated ..Thanks

Labels (3)
Tags (1)
0 Karma
1 Solution

thambisetty
Super Champion

comparison of two times without convert them to epoch is difficult.  converting just year and month to epoch time doesn't happen. I have added 01 as day for each months and compared. add below line to your SPL.

| where (strptime(strftime(_time,"%Y-%m-01"),"%Y-%m-%d"))> (strptime(strftime(now(),"%Y-%m-01"),"%Y-%m-%d"))

 

————————————
If this helps, give a like below.

View solution in original post

thambisetty
Super Champion

comparison of two times without convert them to epoch is difficult.  converting just year and month to epoch time doesn't happen. I have added 01 as day for each months and compared. add below line to your SPL.

| where (strptime(strftime(_time,"%Y-%m-01"),"%Y-%m-%d"))> (strptime(strftime(now(),"%Y-%m-01"),"%Y-%m-%d"))

 

————————————
If this helps, give a like below.

View solution in original post

promukh
Path Finder

perfect thanks for the explanation ..appreciate it !!

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!