Splunk queries

[revanthammineni]

Hi Splunkers,

I"m working on a report where I have to write report on hosts that are not reported for a week.

I used metadata to get all the hosts last reported time.

Example:

time                                    host
1/3/2021                          a1
1/3/2021                          b1
28/2/2021                       c1
27/2/2021                       d1
24/2/2021                       e1
22/2/2021                        f1
22/2/2021                        g1

How can I edit the field time to report  hosts on 22/2/2021 (f1 and g1) ? Your answer would be helpful

Thanks in advance.

[richgalloway]

First, we need to convert the time field to epoch form so we can compare it.  Then we'll compare that value to the epoch time for 7 days ago, which we create using the relative_time function.

... | eval etime=strptime(time, "%d/%m/%Y"), sevenDaysAgo=relative_time(now(), "-7d")
| where etime < sevenDaysAgo