Archive

How can I compare static time value in a lookup field with current system time +/- 5 m?

New Member

I'm just learning splunk so sorry if this is a simple question. I have a lookup with a field that has static time values. How can I compare those static time values with the current system time, not including the date, just the time (plus or minute 5 minutes)?

0 Karma

SplunkTrust
SplunkTrust

You can use now() function, which gives the current time , with relative_time function to compare those time values, something like this

| inputlookup yourlookup.csv | eval Result=if('YourTimeFieldInLookup'>=relative_time(now(),"-5m") OR 'YourTimeFieldInLookup'<=relative_time(now(),"+5m"),"WithinRange","OutsideRange")
0 Karma

New Member

this is close, i'm evaluating with the 'where' clause. I modified this a bit, it seems that its still evaluating the date in the current system time (now). I removed the because it was returning everything that had a value in the field. Is there a way to evaluate against the current system time without the date?

where time=relative_time(now(),"-5m") OR time=relative_time(now(),"+5m")
0 Karma

New Member

and I just realized it doesnt need to evaluate 5 minutes into the future, dunno what i was thinking there.

 where time=relative_time(now(),"-5m")
0 Karma