I am having a field deliveryExpiry (String type) in my log and I want to compare whether the expiry is before the current date or after.Below I am giving the sample log
deliveryExpiry=Wed Dec 25 18:30:00 GMT 2013 deliveryNumber=110 MESSAGE=delivered
i tried something like this
| eval expiryDate=strptime(deliveryExpiry,"%a %b %d %H:%M:%S %Z %Y") | eval current=now() | where expiryDate>strptime(current,"%a %b %d %H %M %S %Z %Y")
but No luck.can anyone please help
The now()
function returns an integer so there's no need to strptime()
it. Using 'where expiryDate>current'
should do the trick.
Have you tried replacing 'where expiryDate=date'
with 'table expiryDate,date'
to see why they don't match?
when i tried the below query then also it didn't work..
| eval expiryDate=strptime(deliveryExpiry,"%a %b %d %H:%M:%S %Z %Y") | eval date=strptime(deliveryExpiry,"%a %b %d %H:%M:%S %Z %Y") | where expiryDate=date
It didn't worked. is it because i am not converting the date properly in expiryDate??