I'm just learning splunk so sorry if this is a simple question. I have a lookup with a field that has static time values. How can I compare those static time values with the current system time, not including the date, just the time (plus or minute 5 minutes)?
this is close, i'm evaluating with the 'where' clause. I modified this a bit, it seems that its still evaluating the date in the current system time (now). I removed the because it was returning everything that had a value in the field. Is there a way to evaluate against the current system time without the date?
where time=relative_time(now(),"-5m") OR time=relative_time(now(),"+5m")