Splunk Search

How to compare field with current weeks Monday?

ojtoids
Explorer

These are ticket platform logs with field 'lastupdated' which contains time and date [2022-04-12 12:12:17.160000+00:00] .
Trying to build a weekly chart where only results that contains "lastupdated" after present weeks monday should be displayed. 

Something like 

if ( lastupdated > monday)

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You want to do something like this

| where strptime(lastupdated, "%F")>relative_time(now(), "@w0")

That is saying 

  • Parse last updated time with %F format (same as %Y-%m-%d)
  • Make sure that time is greater than the previous Sunday (@w0 as relative time to now)

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

You want to do something like this

| where strptime(lastupdated, "%F")>relative_time(now(), "@w0")

That is saying 

  • Parse last updated time with %F format (same as %Y-%m-%d)
  • Make sure that time is greater than the previous Sunday (@w0 as relative time to now)

 

Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...