Hi
I am New to Splunk
I have created one dashboard like below
ProcessName LastUpdated
ProcessA 2019-05-16 14:42:21.12
ProcessB 2019-05-16 14:50:21.12
ProcessC 2019-05-16 14:55:21.12
But now I have to show only those data/results where the difference between EventTimeand LastUpdated is greater than 10 minutes
I have written a search
*index=test source=testSource | table ProcessName LastUpdated |eval diff = _time - strptime(LastUpdated, "%Y-%m-%d %H:%M:%S")| where diff >= 600 *
But I am getting empty result/No reslut though there are some records which fulfills my criteria.
can anyone help ..
@nilanjankc ,
You dont have the _time
in your final result because your are restricting the fields to ProcessName , LastUpdated by using the table
command. Include _time as well in the table
and you should be fine.
Also worth to check the time format and include microseconds if its needed
@nilanjankc ,
You dont have the _time
in your final result because your are restricting the fields to ProcessName , LastUpdated by using the table
command. Include _time as well in the table
and you should be fine.
Also worth to check the time format and include microseconds if its needed
Thank you for your help,its working now