topic compare time format in Splunk Search

compare time format

marellasunil — Sun, 13 Sep 2015 01:30:50 GMT

Hi,
A job needs to be completed by 04:45 AM,
Can some one help me to extract time from the logs, compare 04:45 AM and send an alert.
Kindly help

Re: compare time format

martin_mueller — Sun, 13 Sep 2015 02:27:35 GMT

It'd help if we knew what the time in your logs looked like.

Re: compare time format

marellasunil — Sun, 13 Sep 2015 10:43:33 GMT

Hi Martin,
Thanks for your reply.

In the logs, we have OSTIME field. From OSTIME, we need to extract %H:%M.
Everyday this value need to compare with 04:45, to check the job is runningeven after 04:45 AM

The time format in logs looks like below
OSTIME="11/09/2015 06:05:00"

Re: compare time format

martin_mueller — Sun, 13 Sep 2015 10:59:02 GMT

Mkay... assuming the field OSTIME is already extracted, do something like this:

... | rex field=OSTIME "(?<OS_hour>\d+):(?<OS_minute>\d+)" | eval too_late = if(OS_hour * 60 + OS_minute > 285, "yes", "no")

I'm not treating it as a date because you're not interested in the date, or the entire timestamp. You're just looking to compare the HH:MM portion to see if more than 285 minutes have elapsed since midnight. An alternative, approach using the entire timestamp would be this:

... | eval OSTIME_epoch = strptime(OSTIME, "%m/%d/%Y %H:%M:%S") | eval too_late = if((OSTIME_epoch - relative_time(OSTIME_epoch, "@d")) > (285*60), "yes", "no")

However, this may fail when combined with daylight savings changes... more or less time will have elapsed on those two days when it is 04:45.