Splunk Search

How can I compare static time value in a lookup field with current system time +/- 5 m?

donrtowery
New Member

I'm just learning splunk so sorry if this is a simple question. I have a lookup with a field that has static time values. How can I compare those static time values with the current system time, not including the date, just the time (plus or minute 5 minutes)?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can use now() function, which gives the current time , with relative_time function to compare those time values, something like this

| inputlookup yourlookup.csv | eval Result=if('YourTimeFieldInLookup'>=relative_time(now(),"-5m") OR 'YourTimeFieldInLookup'<=relative_time(now(),"+5m"),"WithinRange","OutsideRange")
0 Karma

donrtowery
New Member

this is close, i'm evaluating with the 'where' clause. I modified this a bit, it seems that its still evaluating the date in the current system time (now). I removed the because it was returning everything that had a value in the field. Is there a way to evaluate against the current system time without the date?

where time=relative_time(now(),"-5m") OR time=relative_time(now(),"+5m")
0 Karma

donrtowery
New Member

and I just realized it doesnt need to evaluate 5 minutes into the future, dunno what i was thinking there.

 where time=relative_time(now(),"-5m")
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...