timestamp filtering not working

[hashbangtech]

hi,
nfdump cannot filter on timestamp using -t
nfdump -r nfcapd.202603282330 -t 2026/03/28.23
output no records
plz help
ty

[phaag]

The -t option is legacy and will be removed. To filter according time, use the syntax:

./nfdump -r ... 'first seen > 2026-03-28T23'

See also the filter paragraph nfdump(1).

[hashbangtech]

ty for a quick response. I ran this command :
nfdump -r nfcapd.202603282330 'first seen > 2026-03-28T23'
Line 1: syntax error at 'first'
please provde me a link for manual of filters
ty

[phaag]

Most likely your nfdump version is too old ....

The option -Z just checks the filter for correct syntax and exists.

% nfdump -V
nfdump: Version: 1.7.7-release  Date: Fri Apr 18 15:22:34 CEST 2025
% nfdump -Z 'first seen > 2026-03-28T23'

As written in my first comment - see nfdump(1) for the complete filter syntax.

[phaag]

seems to work ..