Splunk Search

Compare current time vs fields time

JoshuaJohn
Contributor

I have a checkbox that when ticked I want it to compare the current time vs. the time of the values in a field of the panel. It would then only show the devices that exceed the current time. If unchecked all devices show regardless of time.

alt text
static option true = strftime(_time,"%m/%d/%Y %I:%M:%S %p")
alt text (Field I want to compare to)

0 Karma

micahkemp
Champion

Here is a run anywhere dashboard that uses a recent answers post's sample data to demonstrate what I think you're looking for:

<form>
  <label>622761</label>
   <fieldset submitButton="false">
     <input type="checkbox" token="filter_expired" searchWhenChanged="true">
       <label></label>
       <choice value="yes">Check for expired</choice>
       <delimiter> </delimiter>
       <change>
         <condition value="yes">
           <eval token="checked_result_value">"Status=Expired"</eval>
         </condition>
         <condition>
           <eval token="checked_result_value">""</eval>
         </condition>
       </change>
     </input>
   </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults 
 | eval Class_Date="2018-1-1" 
 | append [| makeresults | eval Class_Date="2018-12-12"] 
 | append [| makeresults | eval Class_Date="2017-1-2"] 
 | append [| makeresults | eval Class_Date="2017-1-3"] 
 | eval class_plus_one_year = relative_time(strptime(Class_Date, "%Y-%m-%d"), "+1y")
 | eval Status = if(now() > class_plus_one_year, "Expired", "Valid")
 | search $checked_result_value$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...