Hi Splunkers,
I"m working on a report where I have to write report on hosts that are not reported for a week.
I used metadata to get all the hosts last reported time.
Example:
time host
1/3/2021 a1
1/3/2021 b1
28/2/2021 c1
27/2/2021 d1
24/2/2021 e1
22/2/2021 f1
22/2/2021 g1
How can I edit the field time to report hosts on 22/2/2021 (f1 and g1) ? Your answer would be helpful
Thanks in advance.
First, we need to convert the time field to epoch form so we can compare it. Then we'll compare that value to the epoch time for 7 days ago, which we create using the relative_time function.
... | eval etime=strptime(time, "%d/%m/%Y"), sevenDaysAgo=relative_time(now(), "-7d")
| where etime < sevenDaysAgo