Hi there,
I am new to this kind of analysis within Splunk but i've been asked to create a filter on events where the closed date is before the start date.
This is the search I have created but can't get it working:
index=main sourcetype="CRA_Consumer_Txt_data" | eval close_date=strftime(strptime(close_date,"%d%m%Y"),"%d/%m/%Y") | eval start_date=strftime(strptime(start_date,"%d%m%Y"),"%d/%m/%Y") | search close_date < start_date | table start_date, close_date
This is an example of what even is shown when i run that search
start_date close_date
30/04/2021 23/05/2021
... View more