Splunk Search

## How to filter time through where clause

Path Finder

Hello All,

Thought I had this down, but not quite. So here is the scenario. I have two Fields  1. "Sent Invite Time"  and 2. "Received Invite Time". Received Invite Time should happen 1440 min from the time "Sent Invite Time occurred" and then searching for when the duration it took between those two fields is over 1440 in min.

The problem I have is that I am getting fields that are coming up as Not Received Invite this is because its not giving Field 2 "Received Invite Time" 1440 min to complete. So how can I do that - have Field 1"Sent Invite Time"  and give it 24 hours for Field 2 to occur from the start of the time that field 1 occurred  ? I was hoping to do this in the where clause....

``| where Field1-Field2>1440 ``

Labels (3)

• ### stats

Tags (1)
1 Solution
SplunkTrust

Assuming that Field1 and Field2 are epoch times, Field2 (when the invite was received) should represent a time greater than Field1 (when the invite was sent) so the where clause should be be where Field2-Field1>1440. This also assumes you have converted the times to epoch-minutes by dividing by 60 since it is normally in seconds. It also assumes you have gathered the two times (Field1 and Field2) into the same event (if they are not already there).

SplunkTrust

Assuming that Field1 and Field2 are epoch times, Field2 (when the invite was received) should represent a time greater than Field1 (when the invite was sent) so the where clause should be be where Field2-Field1>1440. This also assumes you have converted the times to epoch-minutes by dividing by 60 since it is normally in seconds. It also assumes you have gathered the two times (Field1 and Field2) into the same event (if they are not already there).

Get Updates on the Splunk Community!

#### .conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

#### Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

#### Troubleshooting the OpenTelemetry Collector

In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...