Splunk Search

How to determine and compare current time?

metylkinandrey
Communicator

Friends, tell me how to be in the next task.
I have an alert time every two minutes.
I need to use this time, apparently something like this: now();
Next, I need to get the difference between the now() time and the time the last message (t). Let's call the difference between now() and t (t-now);
Enter the variable "interval" (inter), the value of which is 30 seconds;
Then, compare t-now and inter.

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @metylkinandrey,

you have to use the eval command, something like this:

<your_search>
| eval diff=now()-_time)
| where diff>30

If you could share your search I could be more detailed.

Ciao.

Giuseppe

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

I'm not sure what you're after but maybe something like that.

index=test1 earliest=-1d@d
```Let's define now as the current timestamp```
| eval now=now()
```Now let's find when was the latest event in our base search```
| eventstats latest_time(index) AS latest_event_timestamp
```And finally calculate the interval```
| eval interval=now-latest_event_timestamp
```Since we only have one latest_event and one now we don't have to show all events; we could have done "stats latest_time values(now)" as well instead```
| stats values(now) values(latest_event_timestamp) values(interval)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @metylkinandrey,

you have to use the eval command, something like this:

<your_search>
| eval diff=now()-_time)
| where diff>30

If you could share your search I could be more detailed.

Ciao.

Giuseppe

PickleRick
SplunkTrust
SplunkTrust

@gcuselloBut searching this way is kinda pointless. You can as well do

<your_search> latest=-30s

And it makes much more sense (unless it's done way further down the pipeline where it actually might make sens if the _time comes from some heavy processing; otherwise let Splunk take care of time-based limiting).

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...