Splunk Search

Where _time > 3/22/2018

griffinpair
Path Finder

I have events that only time stamp is the Splunk generated _time and I only need to return events after a certain date, 3/22/2018. Simply adding "Where _time > 3/22/2018" does not work and I have attempted converting _time and comparing against that to no avail.

Any suggestions?

jihape
Path Finder

If _time is the time you want to use for searches, using the time picker should work just fine.

skoelpin
SplunkTrust
SplunkTrust

Try this

index=...
| eval epoch=strptime("YOUR_TIME_FIELD", "%m/%d/%Y") 
| where epoch >1521748648
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...