Archive

Add _time field to macro results

Path Finder

Hi, I'm trying to work out a way of adding the existing time to results produced by running the following macro;

| suppression_eventtypes

I'm currently pulling back the following fields;

| fields suppression, start_time, end_time

With the intention being to create some logic which will return any suppression's with an end_time 7 days from the current time. I can work out the logic needed, but am struggling to pull the current time back within the results as it's not produced as a field from the macro.

any ideas? Thanks.

Tags (1)
0 Karma
1 Solution

Legend

@jacqu3sy, Based on the description seems like you need is relative_time() function to give you the epoch time 7 days from current time i.e.

| eval EndTimeThreshold=relative_time(now(),"+7d@d")

Following is a run anywhere search to test your end_time values (if it is string time the same needs to be converted to epoch time using strptime(). If it is already epoch timem, then strptime() is not required)

| makeresults
| eval end_time="2018/03/15"
| eval end_time=strptime(end_time,"%Y/%m/%d")
| eval EndTimeThreshold=relative_time(now(),"+7d@d")
| eval duration=EndTimeThreshold-end_time
| fieldformat EndTimeThreshold=strftime(EndTimeThreshold,"%Y/%m/%d %H:%M:%S")
| eval suppression=if(duration<=604800,"Within 7 Days","Outside 7 Days")

Please try out and confirm.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Legend

@jacqu3sy, Based on the description seems like you need is relative_time() function to give you the epoch time 7 days from current time i.e.

| eval EndTimeThreshold=relative_time(now(),"+7d@d")

Following is a run anywhere search to test your end_time values (if it is string time the same needs to be converted to epoch time using strptime(). If it is already epoch timem, then strptime() is not required)

| makeresults
| eval end_time="2018/03/15"
| eval end_time=strptime(end_time,"%Y/%m/%d")
| eval EndTimeThreshold=relative_time(now(),"+7d@d")
| eval duration=EndTimeThreshold-end_time
| fieldformat EndTimeThreshold=strftime(EndTimeThreshold,"%Y/%m/%d %H:%M:%S")
| eval suppression=if(duration<=604800,"Within 7 Days","Outside 7 Days")

Please try out and confirm.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Path Finder

Thats perfect. Many thanks.

0 Karma

SplunkTrust
SplunkTrust

@jacqu3sy, if your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

SplunkTrust
SplunkTrust

The current time is available from the now function.

... | eval current_time=now() | ...
---
If this reply helps you, an upvote would be appreciated.
0 Karma

Path Finder

great, thanks.

0 Karma