How can I compare static time value in a lookup field with current system time +/- 5 m?

[donrtowery]

I'm just learning splunk so sorry if this is a simple question. I have a lookup with a field that has static time values. How can I compare those static time values with the current system time, not including the date, just the time (plus or minute 5 minutes)?

[somesoni2]

You can use now() function, which gives the current time , with relative_time function to compare those time values, something like this

| inputlookup yourlookup.csv | eval Result=if('YourTimeFieldInLookup'>=relative_time(now(),"-5m") OR 'YourTimeFieldInLookup'<=relative_time(now(),"+5m"),"WithinRange","OutsideRange")

[donrtowery]

this is close, i'm evaluating with the 'where' clause. I modified this a bit, it seems that its still evaluating the date in the current system time (now). I removed the because it was returning everything that had a value in the field. Is there a way to evaluate against the current system time without the date?

where time=relative_time(now(),"-5m") OR time=relative_time(now(),"+5m")

[donrtowery]

and I just realized it doesnt need to evaluate 5 minutes into the future, dunno what i was thinking there.

 where time=relative_time(now(),"-5m")