I had been struggling with the format of this specific query last night, THANK YOU.
I am trying to convert to a date format that SPLUNK can leverage a query from like search "converted_date>-30d@d" but it's not working. (I converted the time from epoch to readable, with or w/out this conversion it wasn't working.)
mail_date is the field in my logs that is the text date.
source="source.log" | eval sent_date=strptime(mail_date,"%d %b %Y") | convert timeformat="%d %b %Y" ctime(sent_date) | dedup sent_date | search sent_date>"-30d@d" | table sent_date
What am I doing wrong?
... View more