Splunk Search

strptime(x,y) usage

pipipipi
Path Finder

hi all,
I confused about strptime.
My goal search is this.(this is a sample. I have month field. I get token in my dashboard and do this search.)

|makeresults
|eval test=strptime("$token$", "%Y-%m")
|where month>strftime(relative_time(test, "-2mon"), "%Y-%m") AND month<="$token$"

I did this search, but test is no result.

|makeresults
|eval test=strptime("2020-02", "%Y-%m")
|where month>strftime(relative_time(test, "-2mon"), "%Y-%m") AND month<="2020-02"

How to change time? Am I wrong using strptime?
Thank you for helping.
(this is easy question, I know, but today, I am stumbling on this problem for some reason.)

0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

You need to provide "day" along with month and year to strptime function. Try this:

| makeresults 
| eval test=strptime("2020-02"."-01", "%Y-%m-%d"), month="2020-01" 
| where month > strftime(relative_time(test, "-2mon"), "%Y-%m") AND month <= "2020-02"

with token:

| makeresults
| eval test=strptime("$token$"."-01", "%Y-%m-%d"), month=??
| where month > strftime(relative_time(test, "-2mon"), "%Y-%m") AND month <= "$token$"

View solution in original post

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

You need to provide "day" along with month and year to strptime function. Try this:

| makeresults 
| eval test=strptime("2020-02"."-01", "%Y-%m-%d"), month="2020-01" 
| where month > strftime(relative_time(test, "-2mon"), "%Y-%m") AND month <= "2020-02"

with token:

| makeresults
| eval test=strptime("$token$"."-01", "%Y-%m-%d"), month=??
| where month > strftime(relative_time(test, "-2mon"), "%Y-%m") AND month <= "$token$"
0 Karma

pipipipi
Path Finder

Thank you so much. I should add "day"...I understand.
Thank you so much.

0 Karma

to4kawa
Ultra Champion

strings(text) can't be compared

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...