Splunk Search

Events older then 30 days

DTERM
Contributor

The following is a sample entry from a splunk index...

lastOccurrence=2012-06-25 18:42:38.0|firstOccurrence=2012-06-18 14:45:59.0|writeTime=2012/06/25 18:40:55|actionCode=U|actionTime=2012-06-25 18:42:39.0|serverName=SERVER1|serverSerial=300998|identifier=10.169.255.trap61 server1.mydomain.com Host State - UP/DOWN|severity=0|alertText=PING OK - Packet loss = 0%, RTA = 0.03 ms|businessUnit=HQ|cmName=server.mydomain.com|deletedBy=|dmName=None|hostGroup=|msgSrc=Nagios|nagios_duration=0d 0h 0m 0s|netcool_duration=|productName=PRIMARY SERVICES|serviceName=Host State - UP/DOWN|supportGroup=SYSADMIN|tally=8200|tgtHostname=server1.mydomin.com|ticketNumber=

How can I extract events that are older then 30 days based on the lastOccurance field. Note the format of the field, I'm not concerned with the hours, minutes, or seconds.

Thanks in advance.

Tags (2)
0 Karma
1 Solution

lguinn2
Legend

I agree with Ayn - you might be able to search based on the splunk timestamp; the search would look like

source=yourfilename latest=-30d@d earliest=0

But, if you really want to search based on the lastOccurance field:

lastOccurence=*
| eval testDate=strptime(lastOccurence,"%Y-%m-%d")
| where testDate < relative_time(now(),"-30d@d")

Duh - I cannot type sometimes. It is probably the spelling.

View solution in original post

lguinn2
Legend

I agree with Ayn - you might be able to search based on the splunk timestamp; the search would look like

source=yourfilename latest=-30d@d earliest=0

But, if you really want to search based on the lastOccurance field:

lastOccurence=*
| eval testDate=strptime(lastOccurence,"%Y-%m-%d")
| where testDate < relative_time(now(),"-30d@d")

Duh - I cannot type sometimes. It is probably the spelling.

lguinn2
Legend

Does it give you any data? What do you get if you run this instead?

lastOccurence=*
| eval testDate=strptime(lastOccurence,"%Y-%m-%d")
| eval lastMo = relative_time(now(),"-30d@d")
| where testDate < lastMo
| table testDate lastMo lastOccurence

(And you might have to leave off the where command if you aren't getting any data)
- Updated for spelling -

meganarellano
Explorer

I had to add an additional eval to get mine to work but this is the answer I've been searching for for a while. Thank you!

|eval test=relative_time(now(),"-90d@d")
|eval test2=strftime(test,"%Y-%m-%d")
|where StartDate > test2

0 Karma

ecanmaster
Explorer

this one works, thx !!

0 Karma

Ayn
Legend

Make sure that the spelling of "lastOccurrence" is correct in your search command.

0 Karma

DTERM
Contributor

That does not work. Not sure why, but it does not work.

0 Karma

Ayn
Legend

Isn't the lastOccurrence field already extracted as the timestamp Splunk uses itself?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...