topic How to determine and compare current time? in Splunk Search

How to determine and compare current time?

metylkinandrey — Tue, 11 Oct 2022 13:59:14 GMT

Friends, tell me how to be in the next task.
I have an alert time every two minutes.
I need to use this time, apparently something like this: now();
Next, I need to get the difference between the now() time and the time the last message (t). Let's call the difference between now() and t (t-now);
Enter the variable "interval" (inter), the value of which is 30 seconds;
Then, compare t-now and inter.

Re: Determine and compare current time

gcusello — Tue, 11 Oct 2022 11:04:00 GMT

Hi @metylkinandrey,

you have to use the eval command, something like this:

<your_search> | eval diff=now()-_time) | where diff>30

If you could share your search I could be more detailed.

Ciao.

Giuseppe

Re: Determine and compare current time

PickleRick — Tue, 11 Oct 2022 11:09:03 GMT

I'm not sure what you're after but maybe something like that.

index=test1 earliest=-1d@d
```Let's define now as the current timestamp```
| eval now=now()
```Now let's find when was the latest event in our base search```
| eventstats latest_time(index) AS latest_event_timestamp
```And finally calculate the interval```
| eval interval=now-latest_event_timestamp
```Since we only have one latest_event and one now we don't have to show all events; we could have done "stats latest_time values(now)" as well instead```
| stats values(now) values(latest_event_timestamp) values(interval)

Re: Determine and compare current time

PickleRick — Tue, 11 Oct 2022 13:11:38 GMT

@gcuselloBut searching this way is kinda pointless. You can as well do

<your_search> latest=-30s

And it makes much more sense (unless it's done way further down the pipeline where it actually might make sens if the _time comes from some heavy processing; otherwise let Splunk take care of time-based limiting).