Splunk Search

filter a column from the table search

NS
Explorer

I am trying to schedule a report where it will give me the list of tickets created in a day. When i put the filter for yesterday from date picker, it is giving me all the tickets that had an event generated yesterday from service-now. I only need the ones that opened on a particular day, not the ones that were updated. For example, my table(created and _time) has below rows and i want only the first one:

created _time

2020-09-02 07:44:552020-09-02 14:52:24
2020-08-28 15:27:362020-09-02 02:27:00
2020-08-21 16:05:462020-09-02 02:25:59
2020-08-24 13:46:392020-09-02 00:53:54

 

Is there a way i can filter this table to get only those rows from created column that have same date as the ones in _time?

This might be the simplest query of all, but I am a newbie here.

Really appreciate if someone could help me.

Labels (1)
0 Karma

Nisha18789
Builder

Hi @NS , you can use epoch time values to compare the current time with created_time in the search 

Below is a run anywhere example 

| makeresults
| eval created_time="2020-09-02 07:44:55,2020-08-28 15:27:36"
| eval created_time = split(created_time,",")
| mvexpand created_time
| eval created_time_epoch=strptime(created_time,"%Y-%m-%d %H:%M:%S")
| eval lower_time=relative_time(_time,"-1d@d"),upper_time=relative_time(_time,"-1d@d+24h")
| where created_time_epoch > lower_time AND created_time_epoch < upper_time

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...