Getting Data In

Difference between latest log time and system time

shakSplunk
Path Finder

Hi all,

I have one field that simply shows that latest timestamp of logs.

i) I was wondering how can I find the difference between the latest log time and the current system time?

ii) Then with that value I was hoping to check run a condition and print the condition to another field (e.g. timeliness). The condition I wanted to implemented was that if the difference is greater than 3 hours, then input "Out of Sync" in the timeliness field. However, in the alternative case, enter "Synced" in the timeliness field. 

My latest log time is in the following format:  2021-07-23 02:54:09

Any help would be greatly appreciated!

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The first step is to convert the latest log time into integer form so it can be compared to the current time.  Use the strptime function for that.

... | eval lastLogEpoch=strptime(lastLogTime, "%Y-%m-%d %H:%M:%S")
| eval status=if(lastLogEpoch > relative_time(now(), "-3h"), "Synced", "Out of Sync")
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The first step is to convert the latest log time into integer form so it can be compared to the current time.  Use the strptime function for that.

... | eval lastLogEpoch=strptime(lastLogTime, "%Y-%m-%d %H:%M:%S")
| eval status=if(lastLogEpoch > relative_time(now(), "-3h"), "Synced", "Out of Sync")
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...