Difference between latest log time and system time

[shakSplunk]

Hi all,

I have one field that simply shows that latest timestamp of logs.

i) I was wondering how can I find the difference between the latest log time and the current system time?

ii) Then with that value I was hoping to check run a condition and print the condition to another field (e.g. timeliness). The condition I wanted to implemented was that if the difference is greater than 3 hours, then input "Out of Sync" in the timeliness field. However, in the alternative case, enter "Synced" in the timeliness field. 

My latest log time is in the following format:  2021-07-23 02:54:09

Any help would be greatly appreciated!

[richgalloway · Accepted solution]

The first step is to convert the latest log time into integer form so it can be compared to the current time.  Use the strptime function for that.

... | eval lastLogEpoch=strptime(lastLogTime, "%Y-%m-%d %H:%M:%S")
| eval status=if(lastLogEpoch > relative_time(now(), "-3h"), "Synced", "Out of Sync")