Splunk Search

Comparison between Future date and current date

dsiob
Communicator

I have a date field 'Start Time' in csv. I have to filter if date in this field is current week date or future week date. For this I fetch '%W' of the date and current date and comparing. But if the date is future date its '%W' is coming as current week only. It is not considering future dates.alt text

Any help will be great!

1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try

/* source*/ | eval StartTimeDetail=case(strptime('Start Time',"%m/%d/%Y %H:%M")>=relative_time(now(),"@w+7d"),"Future Week",strptime('Start Time',"%m/%d/%Y %H:%M")>=relative_time(now(),"@w"),"This Week",1=1,"Prior Week")
| table "Start Time" StartTimeDetail

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Give this a try

/* source*/ | eval StartTimeDetail=case(strptime('Start Time',"%m/%d/%Y %H:%M")>=relative_time(now(),"@w+7d"),"Future Week",strptime('Start Time',"%m/%d/%Y %H:%M")>=relative_time(now(),"@w"),"This Week",1=1,"Prior Week")
| table "Start Time" StartTimeDetail

dsiob
Communicator

Ohh Superb!! its working

0 Karma

twinspop
Influencer

There seems to be a lot of unneeded churn in your search. Does this work for you?

your base search 
| eval InFuture=if((now()-_time)>86400,"yes","no") 
| table _time InFuture

EDIT: you could change 86400 to 0 to catch anything in the future. Or change to 604800 to catch something 1 week in the future or more.

dsiob
Communicator

this returns whether the difference is 1 week or not. But I have to show whether _time is in current week or not

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Why not compare epoch times directly? If _time > now() then the event is in the future.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...