topic Re: Fix column name and evalute times in Splunk Search

How to fix column name and evaluate times?

HelloItsMe76 — Fri, 16 Dec 2022 23:00:30 GMT

I have a dbquery ouput that looks like the below, unfortunately i cant update the actual database query to make it more readable...

2022-12-16 21:30:17.689, TO_CHAR(schema.function(MAX(columnA)),'MM-DD-YYHH24:MI')="12-16-22 16:29"

I am trying to whether time the 2 times at the begining and end of the results are within 15 mins of each other. I have tried renaming the column from the long stupid string but i cant get that working using the rename function. does anyone have any ideas how to rename (or if i even need to) and then evaluate whether the times are within 15 mins of each other?

the query i ran to get the above is just <index="abc">

Re: Fix column name and evalute times

richgalloway — Fri, 16 Dec 2022 22:03:46 GMT

Use rex to extract the two timestamps then use strptime to convert them into epoch (integer) form. Then you can compare then to see how far apart they are.

| makeresults | eval _raw="2022-12-16 21:30:17.689, TO_CHAR(schema.function(MAX(columnA)),'MM-DD-YYHH24:MI')=\"12-16-22 16:29\"" ```Above creates demo data. Delete IRL``` | rex "(?<time1>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d.\d\d\d)" | rex "(?<time2>\d\d-\d\d-\d\d \d\d:\d\d\\\")" | eval diffsecs = strptime(time1, "%Y-%m-%d %H:%M:%S.%3N") - strptime(time2, "%m-%d-%y %H:%M") | eval old=if(abs(diffsecs) > (15*60),1 ,0)

Re: Fix column name and evalute times

HelloItsMe76 — Mon, 19 Dec 2022 15:53:23 GMT

this is beautiful. thanks so much. it works perfectly.