filter data

[numeroinconnu12]

Hello everyone, I have a splunk query that returns the connection ranges with the start and end of the connection. Below is an example. user DateMin DateMax 1234 2020-07-14 04:54:21 2020-07-14 06:02:54 I would just like to display connections that last at least 6 minutes. Thanks.

[anilchaithu]

@numeroinconnu12 

follow these steps

• convert the timestamps into epoch, eval DateMin=strptime(DateMin, "%Y-%m-%d %H:%M:%S")
• difference between the two epoch times will be in seconds, eval Diff=(DateMax-DateMin)
• convert the difference to min, eval Diff=round(Diff/60,2)
• add a filter using where command, where Diff > 6

adding all the above steps together 

eval DateMin=strptime(DateMin, "%Y-%m-%d %H:%M:%S"), DateMax=strptime(DateMax, "%Y-%m-%d %H:%M:%S") | eval Diff=round((DateMax-DateMin)/60,2) | where Diff > 6

you can merge them to a single eval. But I though this will give you good clarity.

Hope this helps