Getting Data In

How to compare date time present in a log with the date time selected from the time range picker?

shannu1241
New Member

I have a log, which has two time fields,

  1. _time(Log indexed time)
  2. StartDate (Date time inside the log)

When i select date range, it compares with _time.

Is there any way to compare date selected from date range with "StartDate" ?? Please help me.

0 Karma

lguinn2
Legend

If the StartDate reflects when the event happened, then the StartDate should be stored in _time. You need to set this up using props.conf on the indexer (unless you are using a heavy forwarder to collect the data). Splunk only uses the time that it indexed the data when it can't find any other timestamp automatically and nothing is configured in props.conf to tell it how to parse. You should read Configure timestamps and fix your data.

There is no way to easily select the StartDate range, as all searches are based on _time. However, if you search over "All Time" or a sufficiently large time period (last 90 days, perhaps?), you can filter based on StartDate. For this to work, StartDate will need to be a Unix-formatted time. It might work something like this.

yoursearchcriteria
| eval Start = strptime(StartDate,"%m-%d-%Y")
| where Start >=relative_time(now(),"-7d@d")

This will select events that have a StartDate within the last week. For it to work, the timerange picker will have to select all events that might have a StartDate with an appropriate time.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...