Splunk Search

How to exclude events where the date greater than today?

ebruozys
Path Finder

Hi,

Is there a way to exclude events in a search where a specific date field (not timestamp) is greater than today. Sow i only want to see events where the specified date field is today or smaller.

0 Karma
1 Solution

FrankVl
Ultra Champion

Try the following, which first parses the date field into a proper date/time value. Then calculates the date/time value for today and then filters events that have a date smaller or equal to today.

... your base search ...
| eval filterdate = strptime(date,"%Y-%m-%d")
| eval today = relative_time(now(),"-0d@d")
| where filterdate <= today

View solution in original post

FrankVl
Ultra Champion

Try the following, which first parses the date field into a proper date/time value. Then calculates the date/time value for today and then filters events that have a date smaller or equal to today.

... your base search ...
| eval filterdate = strptime(date,"%Y-%m-%d")
| eval today = relative_time(now(),"-0d@d")
| where filterdate <= today

ebruozys
Path Finder

Hi Frank,

This is the answer I was looking for. I would rather exclude it in the base search but I guess with the readable time format that is not possible.

0 Karma

FrankVl
Ultra Champion

Can you provide some info on what field that date is in and how it is formatted?

0 Karma

ebruozys
Path Finder

The date field is in a human readable format as follows 2018-03-27 00:00:00.0, sow its YYYY-MM-DD.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...