Unlock a world of possibilities! Login now and discover the exclusive benefits awaiting you.
Hello all,
My data currently has the date listed in the following format:
Jan 29, 2017 22:01:46 EST
I'm trying to change it so it only has 1/29/2017 with no time stamp. How would I accomplish this?
Also, I'm trying to set an expression for when the date is within the last 14 days, display all the data with severity = 'high'
thank you in advance!
I wouldn't be able to share the files, but this is my source code which creates two separate QVDs:
Test:
LOAD Severity AS New_Severity,
[IP Address] AS New_IP_Adress,
[First Discovered],
If(Today() - [First Discovered] <= 14, Dual('0-14 days', 1),
If(Today() - [First Discovered] <= 30, Dual('15-30 days', 2),
If(Today() - [First Discovered] <= 90, Dual('31-90 days', 3), Dual('91-180+ days', 4)))) as Flag,
Date(Floor(TimeStamp#(SubField([First Discovered], ' E', 1), 'MMM DD, YYYY hh:mm:ss'))) as New_First_Discovered,
[Plugin Name] AS New_Plugin_name,
Repository AS New_Repository
FROM
[..\..\..\Source Files\Monthly\Nessus\New Exports - CVA Team\All Vulns - CSN+IS.csv]
(txt, codepage is 1252, embedded labels, delimiter is ',', msq);
//Create the QVD File
STORE Test into $(vQVDlocation)CVATest.qvd(qvd);
Test_1:
LOAD [Plugin Name] AS Closed_Plugin_name,
Severity AS Closed_Severity,
[IP Address] AS Closed_IP_Adress,
Repository AS Closed_Repository,
[Mitigated On],
Date(Floor(TimeStamp#(SubField([Mitigated On], ' E', 1), 'MMM DD, YYYY hh:mm:ss'))) as Closed_Mitigated_On
FROM
[..\..\..\Source Files\Monthly\Nessus\New Exports - CVA Team\All Closed Vulns - CSN+IS.csv]
(txt, codepage is 1252, embedded labels, delimiter is ',', msq);
//Create the QVD File
STORE Test_1 into $(vQVDlocation)CVATest1lo.qvd(qvd);
//Drop tables - since we moved data into the QVD file;
LET vnumTables = NoOfTables();
FOR i=1 to $(vnumTables)
LET vtname = TableName(0);
DROP TABLE [$(vtname)];
NEXT i;
And this is the code for the qvw
Test:
LOAD New_Severity,
New_IP_Adress,
New_First_Discovered,
New_Plugin_name,
New_Repository,
Flag
FROM
$(vQVDlocation)CVATest.qvd (qvd);
Test1:
LOAD Closed_Plugin_name,
Closed_Severity,
Closed_IP_Adress,
Closed_Repository,
Closed_Mitigated_On
FROM
$(vQVDlocation)CVATest1lo.qvd (qvd);
I guess try this
Test:
LOAD *,
If(Today() - New_First_Discovered <= 14, Dual('0-14 days', 1),
If(Today() - New_First_Discovered <= 30, Dual('15-30 days', 2),
If(Today() - New_First_Discovered <= 90, Dual('31-90 days', 3), Dual('91-180+ days', 4)))) as Flag;
LOAD Severity AS New_Severity,
[IP Address] AS New_IP_Adress,
[First Discovered],
Date(Floor(TimeStamp#(SubField([First Discovered], ' E', 1), 'MMM DD, YYYY hh:mm:ss'))) as New_First_Discovered,
[Plugin Name] AS New_Plugin_name,
Repository AS New_Repository
FROM
[..\..\..\Source Files\Monthly\Nessus\New Exports - CVA Team\All Vulns - CSN+IS.csv]
(txt, codepage is 1252, embedded labels, delimiter is ',', msq);
First Discovered isn't read as a date, what makes you think you can do Today() - [First Discovered] on this? Unless you use a field which is dual in nature, you won't be getting any result from that subtraction. I moved the flag calculation to Preceding load and used New_First_Discovered instead of First Discovered to calculate flags