topic Re: Can we pull system time in 'If' Condition in Splunk Search

Can we pull system time in 'If' Condition

amithhegde — Thu, 25 Apr 2013 10:52:57 GMT

I have an alert created where I need to display current system time. There is an If condition in alert which looks something like below.

eval checkstatus=if(isnull(status), "Program has not started at @Current System Time@", "OK")

@Current System Time@ is where i want to have my system time displayed.

Is there a way this can be achieved?

martin_mueller — Thu, 25 Apr 2013 11:53:56 GMT

You can do this:

eval checkstatus=if(isnull(status), "Program has not started at ".strftime(now(), "%F %T"), "OK")

Ayn — Thu, 25 Apr 2013 11:54:44 GMT

now() should be what you're looking for I think?

eval checkstatus=if(isnull(status), "Program has not started at " . now(), "OK")

This gives you the epoch value which might not be what you want, for something more humanly readable you could do

eval checkstatus=if(isnull(status), "Program has not started at " . strftime(now(),"%+"), "OK")