two time fields per event:
_time (default eventfield for Splunk)
occurtime (timestamp within body of event)
I only want to show events where the field in the body of the event: "occurtime" is not more than two days older than "_time".
I have done the following to convert occurtime to epoch time:
eval occur=strptime(occurtime,"%Y-%m-%dT%H:%M:%S")
example current output:
_time: 2020-04-23 05:07:03.151
occurtime: 2020-02-24T17:42:38.572Z
occur: 1582594958.000000
I just need to figure out how the < funcitons with time.
Thank you!
The output of strptime
is an integer and the value of _time is also an integer (it's displayed as text automatically - a helpful, but confusing feature) so comparing _time to occur is the same as comparing any other pair of integers: occur < _time
, for example.
Use relative_time
to factor in the two days. | where occur > relative_time(_time, "-2d")
keeps events where occur is newer than two days before _time.
The output of strptime
is an integer and the value of _time is also an integer (it's displayed as text automatically - a helpful, but confusing feature) so comparing _time to occur is the same as comparing any other pair of integers: occur < _time
, for example.
Use relative_time
to factor in the two days. | where occur > relative_time(_time, "-2d")
keeps events where occur is newer than two days before _time.
Rich-- thank you so much -- I did not know about "relative_time" . That was so helpful, and what you provided was exactly what I needed. 🙂