Getting Data In

Splunk queries

revanthammineni
Path Finder

Hi Splunkers,

I"m working on a report where I have to write report on hosts that are not reported for a week.

I used metadata to get all the hosts last reported time.

Example:

time                                    host
1/3/2021                          a1
1/3/2021                          b1
28/2/2021                       c1
27/2/2021                       d1
24/2/2021                       e1
22/2/2021                        f1
22/2/2021                        g1

How can I edit the field time to report  hosts on 22/2/2021 (f1 and g1) ? Your answer would be helpful

Thanks in advance.

Labels (1)
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

First, we need to convert the time field to epoch form so we can compare it.  Then we'll compare that value to the epoch time for 7 days ago, which we create using the relative_time function.

... | eval etime=strptime(time, "%d/%m/%Y"), sevenDaysAgo=relative_time(now(), "-7d")
| where etime < sevenDaysAgo
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...