Splunk Search

Finding the hosts who time difference is 1hr to 10hrs ?

Path Finder

Hi,

i want to print the hosts,Time difference whose lastTime and recentTime is between 1hr to 10hrs . Below is the query i came up with, but it is not working. Can some one please help me with this ?

| metadata index=xyz type=hosts | eval difference = if((lastTime – recentTime) >=1 OR <= 10, hosts,”no hosts” | table hosts,difference

Thanks

0 Karma

SplunkTrust
SplunkTrust

lastTime and recentTime are epoch timestamps with second resolution, comparing with 1 and 10 is looking for between 1 and 10 seconds. Using OR would always yield true, any number is "greater than one or less than ten". Additionally, the part after the OR has nothing to compare the ten with.

Try this:

| metadata ... | eval hours = (lastTime - recentTime)/3600 | where hours >=1 AND hours <= 10 | table host hours

Note, you likely want (recentTime - lastTime) instead of (lastTime - recentTime), unless your environment is weird.

0 Karma

SplunkTrust
SplunkTrust

One is "A minus B", the other is "B minus A" - the difference between the two will be whether you get positive or negative values.

It depends on what you're looking for - hosts with old data arriving now, or hosts with future data arriving now.

0 Karma

Path Finder

can i please know the difference between (recentTime - lastTime) & (lastTime - recentTime) because when data is streaming both the field values are equal.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!