Splunk Search

How can I compare static time value in a lookup field with current system time +/- 5 m?

donrtowery
New Member

I'm just learning splunk so sorry if this is a simple question. I have a lookup with a field that has static time values. How can I compare those static time values with the current system time, not including the date, just the time (plus or minute 5 minutes)?

0 Karma

somesoni2
Revered Legend

You can use now() function, which gives the current time , with relative_time function to compare those time values, something like this

| inputlookup yourlookup.csv | eval Result=if('YourTimeFieldInLookup'>=relative_time(now(),"-5m") OR 'YourTimeFieldInLookup'<=relative_time(now(),"+5m"),"WithinRange","OutsideRange")
0 Karma

donrtowery
New Member

this is close, i'm evaluating with the 'where' clause. I modified this a bit, it seems that its still evaluating the date in the current system time (now). I removed the because it was returning everything that had a value in the field. Is there a way to evaluate against the current system time without the date?

where time=relative_time(now(),"-5m") OR time=relative_time(now(),"+5m")
0 Karma

donrtowery
New Member

and I just realized it doesnt need to evaluate 5 minutes into the future, dunno what i was thinking there.

 where time=relative_time(now(),"-5m")
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.