topic relative time question in Splunk Search

relative time question

cbr654 — Fri, 15 Oct 2021 19:48:55 GMT

Hello,
There is a tube Splunk video on finding new service interactive logins here:
https://www.youtube.com/watch?v=bgIG2um_Hd0

The following line I just need a better understanding.

| eval isOutlier=if (earliest >= relative_time(now), "-1d@d"), 1, 0)

I understand this much. It is an outlier (1) if :

The earliest time of the first event is greater or equal to the time you ran the search

"-1d@d" -->I am not understanding this part? Is it going back 1 day to find other matches that are also >= relative time (now)?

You would only get an Outlier if the times are the same . If you go back "1d@d" the earliest time of an event 1 day ago will never be equal to the the time you ran the event which is the relative _time(now). How are the matches made when your going back 1d@d? I know I am thinking about this the wrong way. any assistance in understanding the logic would be greatly appreciated.

Re: relative time question

richgalloway — Fri, 15 Oct 2021 20:02:53 GMT

Let's look at it from the inside out (a la Excel's Evaluate Formula feature).

| eval isOutlier=if (earliest >= relative_time(now(), "-1d@d"), 1, 0)

expands to

| eval isOutlier=if (earliest >= relative_time(2021-10-15T15:55:00, "-1d@d"), 1, 0)

The relative_time function works with epoch timestamps, but I'm using text timestamps for understandability.

The "-1d@d" argument to relative_time says to subtract 1 day from the first argument and round off to the beginning of the day. That gives us

| eval isOutlier=if (earliest >= 2021-10-14T00:00:00, 1, 0)

Now we're left with a simple if-then-else. We compare the value of the earliest field to the computed timestamp. If earliest is greater than or equal to the timestamp then it's a newer event and isOutlier is set to 1; otherwise it is set to zero.

Re: relative time question

cbr654 — Sun, 17 Oct 2021 10:46:47 GMT

thank you very much Rich. You explained it in a way that makes send to me