Getting Data In

New field add to existing capture -- time check needed?

mb1226
Engager

I have an application feeding to Splunk for the better part of a couple years now. Last December we change formats and last week we added a new ticket field. We need to insure it was present going forward.

I've daily, weekly and YTD error dashboard scans , some of which are tied to alerts and reports. Mainly double checking user input for missing fields, invalid entries, inappropriate conduct, etc. For this particular field if it is missing before 5/7 it causes a false positive on the error scan. SO aside from the standard time settings , just for this field I need to check to see if the event occurred on or after 5/7 AND is the field is empty. I've a "start time" field in the format 05/07/2020 05:30:54 PM. The CMTicket field is being loaded with something in a format like "T999-999 [9999]" if anything at all. So anything BEFORE 5/7 and blank I need to block but anything on or after 5/7 and blank I need to show as an error. This will be crucial on getting the YTD to do accurate reporting of valid errors. The weekly is almost out of range and will fix itself soon.

I've done lots of dashboards, but this is a first. Any suggestions would be helpful

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Once you convert the start time to integer form, it's easy to compare to a certain date. For example:

... | eval cutover = strptime("05/07/2020", "%m/%d/%Y")
| eval eStartTime = strptime('start time', "%m/%d/%Y %H:%M:%S %p")
| eval CMTicketError = if (eStartTime >= cutover, isnull(CMTicket), false)
...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Once you convert the start time to integer form, it's easy to compare to a certain date. For example:

... | eval cutover = strptime("05/07/2020", "%m/%d/%Y")
| eval eStartTime = strptime('start time', "%m/%d/%Y %H:%M:%S %p")
| eval CMTicketError = if (eStartTime >= cutover, isnull(CMTicket), false)
...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

mb1226
Engager

That worked -- and is a big help - Thanks

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!