Splunk Search

Error comparing Dates in Metadata search

sbsbb
Builder

I'm trying to compare the lastTime from a metadata search, with a relative time to now...

Unfortunatly the comparison doesn't work, I don't understand why

| metadata type=sources | search source=*kivdv.business.msg.* source=*dfi.in.log  | eval now=relative_time(now(),"-60d@d")  | eval last_gt_now=if(lastTime > now,"true","false") |   convert ctime(lastTime),ctime(now) |  table lastTime,now,last_gt_now,source

See screenshot, last_gt_now is always true !alt text

Tags (2)
0 Karma

kristian_kolb
Ultra Champion

Your search will show 'false' if a source hasn't produced any events in the past 60 days. For most cases, your sources will be more talkative than that, right? So 'true' would be the expected result. Looking at the timestamps in the table that the search produces, does this seem to be right?

At least I can get it to work in this fashion. However, you'll need an OR between the sources in the second element of the search query.

/K

somesoni2
Revered Legend

Your search workes fine and provides false value as well for last_gt_now if lastTime is actually less than now.

0 Karma

kristian_kolb
Ultra Champion

sbsbb, yes. The screenshot shows all 'true' - as it should. All dates for last_gt_now are more recent than 60 days ago.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Running the query without the filter here gives me trues and falses correctly at the 60 day cutoff.

sbsbb
Builder

I'm sorry I've forgotten the screenshot... take a look at the results...

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...