topic Re: How to filter a list of timestamps less than _time in Splunk Search

How to filter a list of timestamps less than _time

weidertc — Fri, 25 Jul 2025 14:09:02 GMT

I need to filter a list of timestamps which are less than _time.

this works:

| makeresults count=1 | eval timestamps = mvappend("1570000000", "1570000020") | eval older = mvfilter(timestamps < 1570000010)

but the compared value is whatever is in _time. this does not work:

| makeresults count=1 | eval timestamps = mvappend("1570000000", "1570000020") | eval _time = 1570000010 | eval older = mvfilter(timestamps < _time)

I know timestamps work, because this does work:

| makeresults count=1 | eval timestamps = mvappend("1570000000", "1570000020") | eval older = mvfilter(timestamps < now())

Why does now() and static values work, but this does not:

| makeresults count=1 | eval timestamps = mvappend("1570000000", "1570000020") | eval now_time = now() | eval older = mvfilter(timestamps < now_time)

How can i get a variable in there to compare, since i need to compare the list to _time?

Re: How to filter a list of timestamps less than _time

richgalloway — Fri, 25 Jul 2025 15:53:12 GMT

Have you tried using single quotes to tell eval you're referring to a field name?

| eval older = mvfilter(timestamps < '_time')

Re: How to filter a list of timestamps less than _time

ITWhisperer — Fri, 25 Jul 2025 16:11:44 GMT

mvfilter can only reference one field at a time

Description

This function filters a multivalue field based on an arbitrary Boolean expression. The Boolean expression can reference ONLY ONE field at a time.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/MultivalueEvalFunctions#mvfilter.28.26lt.3Bpredicate.26gt.3B.29

Try like this:

| makeresults count=1 | eval timestamps = mvappend("1700000000", "1800000020") | foreach mode=multivalue timestamps [| eval older=if(<<ITEM>> < _time, mvappend(older,<<ITEM>>),older)]

Re: How to filter a list of timestamps less than _time

weidertc — Fri, 25 Jul 2025 17:13:23 GMT

whoa! i didn't know about mode=multivalue. thanks!