I've got date field in a splunk log that looks like: firstOccurrence=2012/06/27 14:55:12
Splunk does not interpret this as "date" field. As far as Splunk is concerned, it is only a set of strings. What query will allow me to query for all FirstOccurance that is older then 30 days?
Thanks in advance.
You could do something like this:
Assuming splunk is extracting the field "firstOccurrence" with the value "2012/06/27 14:55:12", then you can add something like this to your search:
... | eval first=strptime(firstOccurrence, "%Y/%m/%d %H:%M:%S") | where relative_time(now(), "-30d")>first
However, if this should be the timestamp of your events, then you should get that corrected. Having events indexed without a proper timestamp will create all kinds of issues long-term.
You could do something like this:
Assuming splunk is extracting the field "firstOccurrence" with the value "2012/06/27 14:55:12", then you can add something like this to your search:
... | eval first=strptime(firstOccurrence, "%Y/%m/%d %H:%M:%S") | where relative_time(now(), "-30d")>first
However, if this should be the timestamp of your events, then you should get that corrected. Having events indexed without a proper timestamp will create all kinds of issues long-term.
Perfect!! Thanks so much!!
Isn't the issue here why you haven't had Splunk index this field as something it should use when timestamping events? You've asked about this in a separate thread, I think it's a better idea to carry on the discussion there.