Splunk Search

Convert a time field and use that time to search

FraserC1
Path Finder

Hi,

I have a search which returns a filed name: create_time and the results are like this: 

2020-08-11T17:10:00+0000

What I want to do is this search:

index="automox" sourcetype="automox:software" severity=critical installed=true os_name="Server*" earliest=-1d
| dedup server_name name

But use the time in create_time as the basis for the earliest=-1d search. Is this sort of thing possible?

Cheers.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The earliest keyword applies only to the _time field.  To filter on create_time, use a separate command after converting the field to epoch form.

index="automox" sourcetype="automox:software" severity=critical installed=true os_name="Server*" earliest=-1d
| eval created = strptime(create_time, "%Y-%m-%dT%H:%M:%S%z")
| where created > relative_time(now(), "-1d")
| dedup server_name name
---
If this reply helps you, Karma would be appreciated.
0 Karma

to4kawa
Ultra Champion

index="automox" sourcetype="automox:software" severity=critical installed=true os_name="Server*" 
[search index="automox" sourcetype="automox:software" severity=critical installed=true os_name="Server*" earliest=-1d 
| dedup server_name name | eval creation_time=strptime(creation_time,"%FT%T%z") | eval earliest=relative_time(creation_time,"-1d") | stats min(earliest) as earliest]

0 Karma

FraserC1
Path Finder

Hey thanks for looking at this for me. I ran this search and it returns zero results.
I am unclear what the purpose of the subsearch is here.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...