Splunk Search

## strptime(x,y) usage

Path Finder

hi all,
My goal search is this.(this is a sample. I have month field. I get token in my dashboard and do this search.)

``````|makeresults
|eval test=strptime("\$token\$", "%Y-%m")
|where month>strftime(relative_time(test, "-2mon"), "%Y-%m") AND month<="\$token\$"
``````

I did this search, but test is no result.

``````|makeresults
|eval test=strptime("2020-02", "%Y-%m")
|where month>strftime(relative_time(test, "-2mon"), "%Y-%m") AND month<="2020-02"
``````

How to change time? Am I wrong using strptime?
Thank you for helping.
(this is easy question, I know, but today, I am stumbling on this problem for some reason.)

Tags (4)
1 Solution
Influencer

You need to provide "day" along with month and year to `strptime` function. Try this:

``````| makeresults
| eval test=strptime("2020-02"."-01", "%Y-%m-%d"), month="2020-01"
| where month > strftime(relative_time(test, "-2mon"), "%Y-%m") AND month <= "2020-02"
``````

with token:

``````| makeresults
| eval test=strptime("\$token\$"."-01", "%Y-%m-%d"), month=??
| where month > strftime(relative_time(test, "-2mon"), "%Y-%m") AND month <= "\$token\$"
``````
Influencer

You need to provide "day" along with month and year to `strptime` function. Try this:

``````| makeresults
| eval test=strptime("2020-02"."-01", "%Y-%m-%d"), month="2020-01"
| where month > strftime(relative_time(test, "-2mon"), "%Y-%m") AND month <= "2020-02"
``````

with token:

``````| makeresults
| eval test=strptime("\$token\$"."-01", "%Y-%m-%d"), month=??
| where month > strftime(relative_time(test, "-2mon"), "%Y-%m") AND month <= "\$token\$"
``````
Path Finder

Thank you so much. I should add "day"...I understand.
Thank you so much.

Ultra Champion

strings(text) can't be compared  