Add _time field to macro results

[jacqu3sy]

Hi, I'm trying to work out a way of adding the existing time to results produced by running the following macro;

| suppression_eventtypes

I'm currently pulling back the following fields;

| fields suppression, start_time, end_time

With the intention being to create some logic which will return any suppression's with an end_time 7 days from the current time. I can work out the logic needed, but am struggling to pull the current time back within the results as it's not produced as a field from the macro.

any ideas? Thanks.

[niketn · Accepted solution]

@jacqu3sy, Based on the description seems like you need is relative_time() function to give you the epoch time 7 days from current time i.e.

| eval EndTimeThreshold=relative_time(now(),"+7d@d")

Following is a run anywhere search to test your end_time values (if it is string time the same needs to be converted to epoch time using strptime(). If it is already epoch timem, then strptime() is not required)

| makeresults
| eval end_time="2018/03/15"
| eval end_time=strptime(end_time,"%Y/%m/%d")
| eval EndTimeThreshold=relative_time(now(),"+7d@d")
| eval duration=EndTimeThreshold-end_time
| fieldformat EndTimeThreshold=strftime(EndTimeThreshold,"%Y/%m/%d %H:%M:%S")
| eval suppression=if(duration<=604800,"Within 7 Days","Outside 7 Days")

Please try out and confirm.

[jacqu3sy]

Thats perfect. Many thanks.

[richgalloway]

@jacqu3sy, if your problem is resolved, please accept the answer to help future readers.

[richgalloway]

The current time is available from the now function.

... | eval current_time=now() | ...

[jacqu3sy]

great, thanks.