Archive

How can I use the "where" function to find where the output will be only the last 24hrs of the results?

Engager

Ex: | where first_seen<"24h" or where first_seen="-1d" this is what I used but obviously it's wrong.

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

You would need to make use of relative_time function in there.

If first_seen is in epoch format, then try like this

..| where first_seen>=relative_time(now(),"-24h")

If it's not in epoch, need to convert it to epoch to compare

..| where strptime(first_seen,"<<TimeFormatHere>>") >=relative_time(now(),"-24h")

View solution in original post

SplunkTrust
SplunkTrust

You would need to make use of relative_time function in there.

If first_seen is in epoch format, then try like this

..| where first_seen>=relative_time(now(),"-24h")

If it's not in epoch, need to convert it to epoch to compare

..| where strptime(first_seen,"<<TimeFormatHere>>") >=relative_time(now(),"-24h")

View solution in original post

Engager

Your are the man with the juice!!!

0 Karma