Hi Splunkers,I"m working on a report where I have to write report on hosts that are not reported for a week.I used metadata to get all the hosts last reported time.Example:
time host1/3/2021 a11/3/2021 b128/2/2021 c127/2/2021 d124/2/2021 e122/2/2021 f122/2/2021 g1How can I edit the field time to report hosts on 22/2/2021 (f1 and g1) ? Your answer would be helpfulThanks in advance.
First, we need to convert the time field to epoch form so we can compare it. Then we'll compare that value to the epoch time for 7 days ago, which we create using the relative_time function.
... | eval etime=strptime(time, "%d/%m/%Y"), sevenDaysAgo=relative_time(now(), "-7d")
| where etime < sevenDaysAgo