How to determine and compare current time?

[metylkinandrey]

Friends, tell me how to be in the next task.
I have an alert time every two minutes.
I need to use this time, apparently something like this: now();
Next, I need to get the difference between the now() time and the time the last message (t). Let's call the difference between now() and t (t-now);
Enter the variable "interval" (inter), the value of which is 30 seconds;
Then, compare t-now and inter.

[PickleRick]

I'm not sure what you're after but maybe something like that.

index=test1 earliest=-1d@d
```Let's define now as the current timestamp```
| eval now=now()
```Now let's find when was the latest event in our base search```
| eventstats latest_time(index) AS latest_event_timestamp
```And finally calculate the interval```
| eval interval=now-latest_event_timestamp
```Since we only have one latest_event and one now we don't have to show all events; we could have done "stats latest_time values(now)" as well instead```
| stats values(now) values(latest_event_timestamp) values(interval)

[gcusello · Accepted solution]

Hi @metylkinandrey,

you have to use the eval command, something like this:

<your_search>
| eval diff=now()-_time)
| where diff>30

If you could share your search I could be more detailed.

Ciao.

Giuseppe

[PickleRick]

@gcuselloBut searching this way is kinda pointless. You can as well do

<your_search> latest=-30s

And it makes much more sense (unless it's done way further down the pipeline where it actually might make sens if the _time comes from some heavy processing; otherwise let Splunk take care of time-based limiting).