topic Searching on time in Splunk Search

Searching on time

robK123 — Thu, 17 Jan 2013 16:18:48 GMT

Hi,

I have a search that shows the last time a server last had a virus update but how can I make the search so it only shows machines that have not had a virus update for say 14 days?

Thanks,

Re: Searching on time

jonuwz — Thu, 17 Jan 2013 16:28:39 GMT

... your search here | where last_update < now()-(14*24*60*60)

Re: Searching on time

robK123 — Mon, 28 Sep 2020 13:08:18 GMT

Thanks can you break down what this bit of the search does

< now()-(14*24*60*60)

Thanks,

Re: Searching on time

jonuwz — Mon, 28 Sep 2020 13:10:14 GMT

now() in eval returns the current epoch time, 14*24*60*60 is the number of seconds in 14 days.

So we're checking if the last_update was before that.