Splunk Search

Is there anyway in Splunk to search in Date field?

abi2023
Path Finder

my Spl is 
my base search | transaction ID | stats count values(Date) as Date value(field1) as field1 by ID

I get result 

Date                 field1               ID
02/20/23.         CCC              10
02/10/23
02/05/23

02/10/23.         CC                  08
02/05/23

02/01/23           C                     01

 

Is there anyway in Splunk to search in Date field?

I am try to display result without Date 02/20/23

I try search Date!="02/20/23" and where Date="02/20/23" can anyone help is do able in splunk?

Labels (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

my base search 
| transaction ID 
| stats count values(Date) as Date value(field1) as field1 by ID
| where isnull(mvfind(Date,"02\/20\/23"))

View solution in original post

somesoni2
Revered Legend

Give this a try

my base search 
| transaction ID 
| stats count values(Date) as Date value(field1) as field1 by ID
| where isnull(mvfind(Date,"02\/20\/23"))

abi2023
Path Finder

for the same spl but If I only want latest result show. how can I modify the search? assuming I don't know last event date.  

0 Karma

somesoni2
Revered Legend

Since the mvfind function only support one field reference, it would be difficult to do filter based on dynamic latest Date value. Try this alternate implementation

my base search 
| eventstats latest(Date) as latestDate
| eval shouldInclude=if(Date=latestDate,1,0)
| transaction ID 
| stats count values(Date) as Date value(field1) as field1 max(shouldInclude) as shouldInclude by ID
| where shouldInclude=1

 

0 Karma
Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...