I am trying to filter results based on relative date (last 6 months). Splunk extracted the field I would like to use as a string. Here is an example: Computer Last Seen = "Mon Jun 01 20:26:49 EDT 2015". I have been attempting to use eval strptime to get create a field while searching. It is not working.
Can anyone suggest a better approach?
Thanks.
Assuming the field that Splunk extracted is called Computer_Last_Seen
, try this (15552000=6 months in seconds):
... | lastSeenTimeEpoch = strptime(Computer_Last_Seen, "%a %b %d %H:%M:%S %Z %Y") | eval AgeSeconds = now() - lastSeenTimeEpoch | where AgeSeconds < 15552000