topic After obtaining the Time difference of two time/date fields, if the time greater than a hr create a alert. in Splunk Search

After obtaining the Time difference of two time/date fields, if the time greater than a hr create a alert.

dcephas — Mon, 09 Dec 2019 16:53:39 GMT

Im pretty new to splunk, so my approach may be incorrect. However, At this time my query is as below:

search query
| eval pollingTime=strptime(requestDate,"%Y-%m-%d %H:%M:%S.%3N") 
| eval drainingTime=strptime(receivedDate,"%Y-%m-%d %H:%M:%S.%3N")
| eval timeDiff=tostring((drainingTime-pollingTime),"duration")
| table requestDate receivedDate timeDiff

Which above Im able to obtain timeDiff value in the format (00:00:0.000000). If I want check wether the value us greater then a hour how should I go about doing this?

My thoughts were something like:

| eval isDelayed=if(timeDiff >= ? )

Re: After obtaining the Time difference of two time/date fields, if the time greater than a hr create a alert.

zacharychristen — Mon, 09 Dec 2019 18:02:47 GMT

You can perform the evaluation before converting the variable to a string. For example:

     ...
    | eval pollingTime=strptime(requestDate,"%Y-%m-%d %H:%M:%S.%3N") 
    | eval drainingTime=strptime(receivedDate,"%Y-%m-%d %H:%M:%S.%3N")
    | eval timeDiff=(drainingTime-pollingTime)
    | where timeDiff>3600 
    | eval timeDiff=tostring(timeDiff, "duration")
    | table requestDate receivedDate timeDiff

If timeDiff is greater than 3600 seconds (1 hour), then only those events will show up.

Re: After obtaining the Time difference of two time/date fields, if the time greater than a hr create a alert.

dcephas — Mon, 09 Dec 2019 19:09:48 GMT

Thank you this works perfectly for me