topic Re: applying current time multiple times (per specific event) in Splunk Search

applying current time multiple times (per specific event)

PawelSplunk — Tue, 02 Apr 2024 13:37:36 GMT

Hello Everyone

I'm trying to calculate the "time_difference" between one column and another in Splunk. The problem is that the value from which I substract something is current time and when I use the current time value it is shown in a table as one event (epoch_current_time). Therefore when I substract value "epoch_password_last_modified" from "epoch_current_time" i get no results. Is there a way to make "epoch_current_time" visible each time in each row like "epoch_password_last_modified" value?

Re: applying current time multiple times (per specific event)

ITWhisperer — Tue, 02 Apr 2024 14:11:43 GMT

It looks like "epoch_password_last_modified" is a multivalue field; assuming you want to continue processing this a set of multivalue fields (although I think you might be better off expanding to individual events or not creating the multivalue fields in the first place), you could try something like this

| eval time_difference=mvmap(epoch_password_last_modified, epoch_current_time - epoch_password_last_modified)

Re: applying current time multiple times (per specific event)

PawelSplunk — Wed, 03 Apr 2024 06:22:39 GMT

Yes. Thank You very much. It works.