Splunk Search

Convert a time field and use that time to search

Path Finder

Hi,

I have a search which returns a filed name: create_time and the results are like this: 

2020-08-11T17:10:00+0000

What I want to do is this search:

index="automox" sourcetype="automox:software" severity=critical installed=true os_name="Server*" earliest=-1d
| dedup server_name name

But use the time in create_time as the basis for the earliest=-1d search. Is this sort of thing possible?

Cheers.

0 Karma

SplunkTrust
SplunkTrust

The earliest keyword applies only to the _time field.  To filter on create_time, use a separate command after converting the field to epoch form.

index="automox" sourcetype="automox:software" severity=critical installed=true os_name="Server*" earliest=-1d
| eval created = strptime(create_time, "%Y-%m-%dT%H:%M:%S%z")
| where created > relative_time(now(), "-1d")
| dedup server_name name
---
If this reply helps you, an upvote would be appreciated.
0 Karma

SplunkTrust
SplunkTrust

index="automox" sourcetype="automox:software" severity=critical installed=true os_name="Server*" 
[search index="automox" sourcetype="automox:software" severity=critical installed=true os_name="Server*" earliest=-1d 
| dedup server_name name | eval creation_time=strptime(creation_time,"%FT%T%z") | eval earliest=relative_time(creation_time,"-1d") | stats min(earliest) as earliest]

0 Karma

Path Finder

Hey thanks for looking at this for me. I ran this search and it returns zero results.
I am unclear what the purpose of the subsearch is here.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!