Current date exclusion from search events

[drewbfl]

I have an event that contains the following date format/range text within it:

2011-10-07T00:00:00.000Z-2011-10-07T12:00:00.000Z

I would like to exclude any events whose second part of that range (in this case 2011-10-07T12:00:00.000Z) are within 24hrs of current time.

I have tried using now() with fields and reformatting, then using rex mode=sed to exclude now() but I am missing something.

Thanks.

[hexx · Accepted solution]

1 - Extract the boundaries of your time range into their own fields. Let's say latest_time_boundary and earliest_time_boundary. You can use an inline rex to do this.

Quick and dirty example :

| rex (?<earliest_time_boundary>(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z)-(?<latest_time_boundary>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z)

2 - Use convert's mktime() function to convert the boundaries of your time range to epoch times. This would look like :

| convert timeformat=%Y-%m-%dT%H:%M:%S.%3NZ mktime(latest_time_boundary)

3 - Using eval, create a new field that shows the delta in seconds between the time at which the search ran (now()) and the upper boundary of the time range :

| eval elapsed_seconds=(now() - latest_time_boundary)

4 - Exclude any events for which that delta is less than 24 hours / 86,400 seconds :

| search elapsed_seconds>86400

[drewbfl]

Thanks, worked perfect!