Splunk Search

Filter by time where date is in seperate field

user93
Communicator

I need some help to filter by time, but the time field is not the internal Splunk time field. Instead, it is a date field from a lookup spreadsheet that corresponds to the objects file creation.

I want to be able to filter on objects that are created only in the previous month.

The format of the lookup date field is like this:

Created=8/26/2019 17:01

Tags (2)
0 Karma

eduardKiyko
Explorer

You can create _time field right in search query, like this:


| eval _time=strptime(Created,"%Y-%m-%d %H:%M:%S")

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...