Splunk Search

Getting rid of hours when comparing two dates

andilee
Explorer

Hi there! I have a query which compares two dates and returns a result showing which date is furthest is the future.

  • One of the date fields shows the date as dd/mm/yyyy.
  • The second date field shows the date as dd/mm/yyyy HH:mm:ss.

Because of this, the second date field is consistently showing as higher than the first, even when it actually isn't.

Has anyone got any ideas about how I could get rid of the HH:mm:ss from the second date field? I'm assuming if I get rid of that the eval will work correctly!

Thanks in anticipation!
Andrea

0 Karma
1 Solution

linu1988
Champion

Hello Andrea,
If you are directly comparing the dates it might be in string format. Best way will be to convert it to epoch time format and then make a comparison. Please try this sample search

sourcetype=x|eval Date1=strptime(field1,"%d/%m/%Y")|eval Date2=strptime(field1,"%d/%m/%Y %H:%M:%S")|eval Greater=if(Date1>Date2,"Yes","No")|table Date1,Date2,Greater

Thanks

View solution in original post

andilee
Explorer

Hooray!! One date still has hours, the other doesn't - but the result is correct, and that is what matters 🙂

Thank you so much for your help!!

0 Karma

linu1988
Champion

Hello Andrea,
If you are directly comparing the dates it might be in string format. Best way will be to convert it to epoch time format and then make a comparison. Please try this sample search

sourcetype=x|eval Date1=strptime(field1,"%d/%m/%Y")|eval Date2=strptime(field1,"%d/%m/%Y %H:%M:%S")|eval Greater=if(Date1>Date2,"Yes","No")|table Date1,Date2,Greater

Thanks

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...