Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to compare using eval expression and field value pair

$
0
0
I want the table to be generated based on 2 conditions - one condition is comparing eval expression and other field value pair.. how to do that index="myindex" |eval Due_Date_Time = strftime(strptime('Due By',"%d.%m.%Y"),"%d.%m.%Y")|eval now_time=strftime(now(),"%d.%m.%Y")|table ID,Category | where (now_time>=Due_Date_Time) AND ('System Status'!="Completed") This where clause is not working.. please help

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>