topic Using eval with table in Splunk Search

Using eval with table

asarolkar — Fri, 30 Nov 2012 22:55:09 GMT

I have a log by the name of auditlog, which logs accountNumber AND accountCreateDt

accountCreateDt = %Y-%m-%d format.

I am trying to identify Accounts that were created less than 24 hours ago by executing this search.

sourcetype="auditlog" | convert timeformat="%Y-%m-%d" mktime(accountCreateDt) as lastTime | convert mktime(_time) as c_time | eval Diff=c_time - lastTime | where Diff < 86400 | table accountNumber

For some reason, this query is not working.

IF i replace the last query with | table Diff it works like a charm (it gives me all time difference as long as account was created less than 24 hours ago).

Am i not using eval and table correctly ?

Re: Using eval with table

lguinn2 — Fri, 30 Nov 2012 23:12:39 GMT

It looks mostly okay, but I think you are doing it the hard way:

sourcetype=auditlog
| eval lastTime = strptime(accountCreateDt,"%Y-%m-%d")
| where lastTime > relative_time(now(), "-24h")
| table accountNumber accountCreateDt

One of the variables that you are using is _time - that is the the timestamp of the event; it will vary with each event. now() is the starting time of the search. I think that now() is what you should be using here, no matter how you choose to calculate things.

Re: Using eval with table

asarolkar — Sat, 01 Dec 2012 00:16:58 GMT

I like the idea of using now() more than _time.

Also this is a much simpler solution