Splunk Search

## strptime(x,y) usage

Path Finder

hi all,
I confused about strptime.
My goal search is this.(this is a sample. I have month field. I get token in my dashboard and do this search.)

|makeresults
|eval test=strptime("\$token\$", "%Y-%m")
|where month>strftime(relative_time(test, "-2mon"), "%Y-%m") AND month<="\$token\$"

I did this search, but test is no result.

|makeresults
|eval test=strptime("2020-02", "%Y-%m")
|where month>strftime(relative_time(test, "-2mon"), "%Y-%m") AND month<="2020-02"

How to change time? Am I wrong using strptime?
Thank you for helping.
(this is easy question, I know, but today, I am stumbling on this problem for some reason.)

Tags (4)
1 Solution
Influencer

You need to provide "day" along with month and year to strptime function. Try this:

| makeresults
| eval test=strptime("2020-02"."-01", "%Y-%m-%d"), month="2020-01"
| where month > strftime(relative_time(test, "-2mon"), "%Y-%m") AND month <= "2020-02"

with token:

| makeresults
| eval test=strptime("\$token\$"."-01", "%Y-%m-%d"), month=??
| where month > strftime(relative_time(test, "-2mon"), "%Y-%m") AND month <= "\$token\$"
Influencer

You need to provide "day" along with month and year to strptime function. Try this:

| makeresults
| eval test=strptime("2020-02"."-01", "%Y-%m-%d"), month="2020-01"
| where month > strftime(relative_time(test, "-2mon"), "%Y-%m") AND month <= "2020-02"

with token:

| makeresults
| eval test=strptime("\$token\$"."-01", "%Y-%m-%d"), month=??
| where month > strftime(relative_time(test, "-2mon"), "%Y-%m") AND month <= "\$token\$"
Path Finder

Thank you so much. I should add "day"...I understand.
Thank you so much.

Ultra Champion

strings(text) can't be compared