I've got date field in a splunk log that looks like: firstOccurrence=2012/06/27 14:55:12
Splunk does not interpret this as "date" field. As far as Splunk is concerned, it is only a set of strings. What query will allow me to query for all FirstOccurance that is older then 30 days?
Thanks in advance.
asked 27 Jun '12, 10:23
You could do something like this:
Assuming splunk is extracting the field "firstOccurrence" with the value "2012/06/27 14:55:12", then you can add something like this to your search:
However, if this should be the timestamp of your events, then you should get that corrected. Having events indexed without a proper timestamp will create all kinds of issues long-term.
answered 27 Jun '12, 11:45