Splunk Search

Date displaying as a string

cc3658
Explorer

I have a string field (publication_date) that is displaying a date in the following format YYYY/mm/dd. Ultimately I would like to display in a dashboard any logs displaying a publication_date within the last 7 days.

I suspect I am having trouble because it is a sting field and not numeric but have been unsuccessful in finding the correct syntax.

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

In general, you want the strptime() function to change the display format into epoch time format, and strftime() to go the other way.

However, in this case, because the ISO format you showed will sort dates into the same order, you can just change current date - 7 days into the same format and compare directly.

  | eval testDate = strftime(now()-7*24*3600,"%Y/%m/%d")
  | where publication_date >= testDate

Change >= to > if you want to exclude the date one week ago (ie exclude last Friday if today is Friday).

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

In general, you want the strptime() function to change the display format into epoch time format, and strftime() to go the other way.

However, in this case, because the ISO format you showed will sort dates into the same order, you can just change current date - 7 days into the same format and compare directly.

  | eval testDate = strftime(now()-7*24*3600,"%Y/%m/%d")
  | where publication_date >= testDate

Change >= to > if you want to exclude the date one week ago (ie exclude last Friday if today is Friday).

0 Karma

cc3658
Explorer

This worked for me. This is the part that I was missing "(now()-7*24*3600" Thanks!

DalJeanis
SplunkTrust
SplunkTrust

@cc3658 - in real code, I'd multiply that out, but for the forum I wanted it to be obvious what the number meant.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...