I'm trying to compare two date values, Valid_Till(ex: Oct 7 12:58:21 2016) and the current_date(ex: 08/01/16). In order to create a consistent format, I want to convert Valid_Till to numeric values so that it matches current_date's format. What would be the best way to do this? I've tried using strptime, but it didn't work out.
Hi jenniferleenyc,
take this run everywhere search :
| gentimes start=-1
| eval foo1="Oct 7 12:58:21 2016", foo2="08/01/16"
| eval boo1=strptime(foo1, "%b %e %H:%M:%S %Y"), boo2=strptime(foo2, "%m/%d/%y")
| table foo1 foo2 boo1 boo2
This will create some dummy fields and using strptime
you will parse the values of foo1
and foo2
into epoch values which later can be compared. See the docs on strptime
http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/CommonEvalFunctions#Date_and_Time_...
This function takes a time represented by a string, X, and parses it into a timestamp using the format specified by Y.
For more information on the time format option see http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Commontimeformatvariables
Hope this helps ...
cheers, MuS
What was the search you tried?
Something like below should work
| eval Valid_Till_epoch = strptime(Valid_Till, "%b %d %H:%M:%S %Y")
Try this run anywhere sample. This converts the Valid_Till & current_date format to epoch time
| gentimes start=-1 | eval x="Oct 7 12:58:21 2016" | eval y=strptime(x, "%b %-d %H:%M:%S %Y") | eval a="08/01/16" | eval b=strptime(a, "%m/%d/%y") | table x y a b