Refine your search:

I've got date field in a splunk log that looks like: firstOccurrence=2012/06/27 14:55:12

Splunk does not interpret this as "date" field. As far as Splunk is concerned, it is only a set of strings. What query will allow me to query for all FirstOccurance that is older then 30 days?

Thanks in advance.

asked 27 Jun '12, 10:23

DTERM's gravatar image

DTERM
3299943
accept rate: 53%

Isn't the issue here why you haven't had Splunk index this field as something it should use when timestamping events? You've asked about this in a separate thread, I think it's a better idea to carry on the discussion there.

(27 Jun '12, 10:51) Ayn ♦

One Answer:

You could do something like this:

Assuming splunk is extracting the field "firstOccurrence" with the value "2012/06/27 14:55:12", then you can add something like this to your search:

... | eval first=strptime(firstOccurrence, "%Y/%m/%d %H:%M:%S") | where relative_time(now(), "-30d")>first

However, if this should be the timestamp of your events, then you should get that corrected. Having events indexed without a proper timestamp will create all kinds of issues long-term.

link

answered 27 Jun '12, 11:45

Lowell's gravatar image

Lowell ♦
12.4k2422113
accept rate: 41%

Perfect!! Thanks so much!!

(28 Jun '12, 11:09) DTERM
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×191

Asked: 27 Jun '12, 10:23

Seen: 730 times

Last updated: 28 Jun '12, 11:09

Copyright © 2005-2014 Splunk Inc. All rights reserved.