Error comparing Dates in Metadata search

[sbsbb]

I'm trying to compare the lastTime from a metadata search, with a relative time to now...

Unfortunatly the comparison doesn't work, I don't understand why

| metadata type=sources | search source=*kivdv.business.msg.* source=*dfi.in.log  | eval now=relative_time(now(),"-60d@d")  | eval last_gt_now=if(lastTime > now,"true","false") |   convert ctime(lastTime),ctime(now) |  table lastTime,now,last_gt_now,source

See screenshot, last_gt_now is always true !

[kristian_kolb]

Your search will show 'false' if a source hasn't produced any events in the past 60 days. For most cases, your sources will be more talkative than that, right? So 'true' would be the expected result. Looking at the timestamps in the table that the search produces, does this seem to be right?

At least I can get it to work in this fashion. However, you'll need an OR between the sources in the second element of the search query.

/K

[somesoni2]

Your search workes fine and provides false value as well for last_gt_now if lastTime is actually less than now.

[kristian_kolb]

sbsbb, yes. The screenshot shows all 'true' - as it should. All dates for last_gt_now are more recent than 60 days ago.

[martin_mueller]

Running the query without the filter here gives me trues and falses correctly at the 60 day cutoff.

[sbsbb]

I'm sorry I've forgotten the screenshot... take a look at the results...