https://community.splunk.com/t5/Getting-Data-In/Difference-between-latest-log-time-and-system-time/m-p/560514#M92646 <P>Hi all,</P><P>I have one field that simply shows that latest timestamp of logs.</P><P>i) I was wondering how can I find the difference between the latest log time and the current system time?</P><P>ii) Then with that value I was hoping to check run a condition and print the condition to another field (e.g. timeliness). The condition I wanted to implemented was that if the difference is greater than 3 hours, then input "Out of Sync" in the timeliness field. However, in the alternative case, enter "Synced" in the timeliness field.&nbsp;</P><P>My latest log time is in the following format:&nbsp;&nbsp;<SPAN>2021-07-23 02:54:09</SPAN></P><P><SPAN>Any help would be greatly appreciated!</SPAN></P> Thu, 22 Jul 2021 18:49:44 GMT shakSplunk 2021-07-22T18:49:44Z https://community.splunk.com/t5/Getting-Data-In/Difference-between-latest-log-time-and-system-time/m-p/560514#M92646 <P>Hi all,</P><P>I have one field that simply shows that latest timestamp of logs.</P><P>i) I was wondering how can I find the difference between the latest log time and the current system time?</P><P>ii) Then with that value I was hoping to check run a condition and print the condition to another field (e.g. timeliness). The condition I wanted to implemented was that if the difference is greater than 3 hours, then input "Out of Sync" in the timeliness field. However, in the alternative case, enter "Synced" in the timeliness field.&nbsp;</P><P>My latest log time is in the following format:&nbsp;&nbsp;<SPAN>2021-07-23 02:54:09</SPAN></P><P><SPAN>Any help would be greatly appreciated!</SPAN></P> Thu, 22 Jul 2021 18:49:44 GMT https://community.splunk.com/t5/Getting-Data-In/Difference-between-latest-log-time-and-system-time/m-p/560514#M92646 shakSplunk 2021-07-22T18:49:44Z https://community.splunk.com/t5/Getting-Data-In/Difference-between-latest-log-time-and-system-time/m-p/560520#M92647 <P>The first step is to convert the latest log time into integer form so it can be compared to the current time.&nbsp; Use the strptime function for that.</P><LI-CODE lang="markup">... | eval lastLogEpoch=strptime(lastLogTime, "%Y-%m-%d %H:%M:%S") | eval status=if(lastLogEpoch &gt; relative_time(now(), "-3h"), "Synced", "Out of Sync")</LI-CODE> Thu, 22 Jul 2021 19:53:05 GMT https://community.splunk.com/t5/Getting-Data-In/Difference-between-latest-log-time-and-system-time/m-p/560520#M92647 richgalloway 2021-07-22T19:53:05Z