Splunk Search

date strftime convert and show last 4 days

felipesewaybric
Contributor

Hey guys, i have | eval Date=strftime(strptime(data,"%Y/%m/%d"),"%m/%d") returning

07/02
07/01
06/30
06/29
06/28

but i want to receive only the last 4 days.

07/02
07/01
06/30
06/29

The data is in a lookup_table csv

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

String comparisons are usually bad news. Consider this instead:

| where strptime(data,"%Y/%m/%d") >= relative_time(now(), "-4d")

That way the comparison is done using numbers / epoch time, so there's no ambiguity in case your date formatting requirements change.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

String comparisons are usually bad news. Consider this instead:

| where strptime(data,"%Y/%m/%d") >= relative_time(now(), "-4d")

That way the comparison is done using numbers / epoch time, so there's no ambiguity in case your date formatting requirements change.

View solution in original post

felipesewaybric
Contributor

ok, i think i found what i need:

| where Date >= strftime(relative_time(now(), "-4d"), "%m/%d")

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!