I need to be able to search for log entries with a specific start date, which has nothing to do with _time
. The format is, for example, Start_Date: 08/26/2013 4:30 PM
.
I need to add a condition in my search to specify the date, but not the time. I tried strptime
and strftime
unsuccessfully.
For example, I tried converting start date to a string (without time) and compare it to another string:
"08/26/2013"=strftime(Start_Date, "%d/%m/%Y")
This didn't work either:
"08/26/2013"=strftime(strptime(Start_Date "%d/%m/%Y %I:%M %p"), "%d/%m/%Y")
Any ideas how to solve this?
If Start_Date
is an extracted field you can just add it to the search in a key=value format, e.g;
host=blah sourcetype=bleh Start_Date=08/26/2013*
If it is not an extracted field, and you do not wish it to be, you can extract within the search first;
host=blah sourcetype=bleh | rex "Start_Date:\s(?<Start_Date>\S+)" | search Start_Date=06/26/2013*
Your use of strftime/strptime
is not correct. Those two are functions of eval
.
Hope this helps,
K
If you want to use comparison operators instead of just making sure the string is equal to "08/26/2013 4:30 PM" (e.g. "return all events that have a start date after 09/24/2012"), you will need to convert the time into epoch seconds.
<base search> | eval start-epoch=strptime(Start_Date, "%m/%d/%Y %I:%M %p")
This will give you a new field start-epoch that may be used for comparison purposes.
NOTE: This assumes you have a field called Start_Date. If you do not, you will need to extract the date similarly to how kristian.kolb did in the other answer provided.
Hope this helps! 🙂
References:
If Start_Date
is an extracted field you can just add it to the search in a key=value format, e.g;
host=blah sourcetype=bleh Start_Date=08/26/2013*
If it is not an extracted field, and you do not wish it to be, you can extract within the search first;
host=blah sourcetype=bleh | rex "Start_Date:\s(?<Start_Date>\S+)" | search Start_Date=06/26/2013*
Your use of strftime/strptime
is not correct. Those two are functions of eval
.
Hope this helps,
K
Thanks! Start_Date=08/26/2013*
works perfectly.
Use
search sourcetype="comparison" | eval existing_date=functions()
instead of comparing between 2 different dates of your search solve
evaluation function instead of equal sign, 2 different dates can not be equal try to use your existing dates to be compatible with your start_date format
Hope this will help.