Splunk Enterprise Security

ignore timestamp greater than 2 days

arikanter
Observer

two time fields per event:
_time (default eventfield for Splunk)
occurtime (timestamp within body of event)

I only want to show events where the field in the body of the event: "occurtime" is not more than two days older than "_time".

I have done the following to convert occurtime to epoch time:
eval occur=strptime(occurtime,"%Y-%m-%dT%H:%M:%S")

example current output:

_time: 2020-04-23 05:07:03.151

occurtime: 2020-02-24T17:42:38.572Z

occur: 1582594958.000000

I just need to figure out how the < funcitons with time.

Thank you!

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The output of strptime is an integer and the value of _time is also an integer (it's displayed as text automatically - a helpful, but confusing feature) so comparing _time to occur is the same as comparing any other pair of integers: occur < _time, for example.

Use relative_time to factor in the two days. | where occur > relative_time(_time, "-2d") keeps events where occur is newer than two days before _time.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The output of strptime is an integer and the value of _time is also an integer (it's displayed as text automatically - a helpful, but confusing feature) so comparing _time to occur is the same as comparing any other pair of integers: occur < _time, for example.

Use relative_time to factor in the two days. | where occur > relative_time(_time, "-2d") keeps events where occur is newer than two days before _time.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

arikanter
Observer

Rich-- thank you so much -- I did not know about "relative_time" . That was so helpful, and what you provided was exactly what I needed. 🙂

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...