topic How to search based on the the time field from the event? in Splunk Search

How to search based on the the time field from the event?

bhuvanabala — Tue, 18 Jun 2019 06:42:54 GMT

Hi Team,

I am having field called expirationdatetime in my event and its format is 2019-06-21T06:08:40.220082Z. My requirement is to get the count of users whose request going to expire in next 2 days.

Built a search - index="XXX" sourcetype="RRR" expirationdatetime=now+2d

When i hit the above expression, i didnt get any events.

Help on this

Re: How to search based on the the time field from the event?

pramit46 — Tue, 18 Jun 2019 07:46:43 GMT

@bhuvanabala,

Does this help?

| makeresults 
| eval time_given="2019-06-20T06:08:40.220082Z" 
| eval time_given_in_epoch_format=strptime(time_given,"%Y-%m-%dT%H:%M:%S.%Q") 
| eval time_2_days_from_now=relative_time(now(),"+2d") 
| eval time_2_days_from_now_human_readable=strftime(time_2_days_from_now,"%Y-%m-%d %H:%M:%S.%Q")
| eval breach=if(time_given_in_epoch_format>=time_2_days_from_now,1,0)
|table breach

Re: How to search based on the the time field from the event?

DavidHourani — Tue, 18 Jun 2019 19:09:04 GMT

Hi @bhuvanabala,

This should do the trick :

index="XXX" sourcetype="RRR" 
|eval expirationdatetime=strptime(expirationdatetime,"%Y-%m-%dT%H:%M:%S.%Q") 
|where expirationdatetime < relative_time(now(), "-+2d")

Let me know if it helps.

Cheers,
David