ignore timestamp greater than 2 days

[arikanter]

two time fields per event:
_time (default eventfield for Splunk)
occurtime (timestamp within body of event)

I only want to show events where the field in the body of the event: "occurtime" is not more than two days older than "_time".

I have done the following to convert occurtime to epoch time:
eval occur=strptime(occurtime,"%Y-%m-%dT%H:%M:%S")

example current output:

_time: 2020-04-23 05:07:03.151

occurtime: 2020-02-24T17:42:38.572Z

occur: 1582594958.000000

I just need to figure out how the < funcitons with time.

Thank you!

[richgalloway · Accepted solution]

The output of strptime is an integer and the value of _time is also an integer (it's displayed as text automatically - a helpful, but confusing feature) so comparing _time to occur is the same as comparing any other pair of integers: occur < _time, for example.

Use relative_time to factor in the two days. | where occur > relative_time(_time, "-2d") keeps events where occur is newer than two days before _time.

[arikanter]

Rich-- thank you so much -- I did not know about "relative_time" . That was so helpful, and what you provided was exactly what I needed. 🙂