Splunk Search

How to filter time through where clause

MeMilo09
Path Finder

Hello All, 

Thought I had this down, but not quite. So here is the scenario. I have two Fields  1. "Sent Invite Time"  and 2. "Received Invite Time". Received Invite Time should happen 1440 min from the time "Sent Invite Time occurred" and then searching for when the duration it took between those two fields is over 1440 in min. 

The problem I have is that I am getting fields that are coming up as Not Received Invite this is because its not giving Field 2 "Received Invite Time" 1440 min to complete. So how can I do that - have Field 1"Sent Invite Time"  and give it 24 hours for Field 2 to occur from the start of the time that field 1 occurred  ? I was hoping to do this in the where clause.... 

 

| where Field1-Field2>1440 

 




Labels (3)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming that Field1 and Field2 are epoch times, Field2 (when the invite was received) should represent a time greater than Field1 (when the invite was sent) so the where clause should be be where Field2-Field1>1440. This also assumes you have converted the times to epoch-minutes by dividing by 60 since it is normally in seconds. It also assumes you have gathered the two times (Field1 and Field2) into the same event (if they are not already there).

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming that Field1 and Field2 are epoch times, Field2 (when the invite was received) should represent a time greater than Field1 (when the invite was sent) so the where clause should be be where Field2-Field1>1440. This also assumes you have converted the times to epoch-minutes by dividing by 60 since it is normally in seconds. It also assumes you have gathered the two times (Field1 and Field2) into the same event (if they are not already there).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...