Splunk Search

How to filter time through where clause

MeMilo09
Path Finder

Hello All, 

Thought I had this down, but not quite. So here is the scenario. I have two Fields  1. "Sent Invite Time"  and 2. "Received Invite Time". Received Invite Time should happen 1440 min from the time "Sent Invite Time occurred" and then searching for when the duration it took between those two fields is over 1440 in min. 

The problem I have is that I am getting fields that are coming up as Not Received Invite this is because its not giving Field 2 "Received Invite Time" 1440 min to complete. So how can I do that - have Field 1"Sent Invite Time"  and give it 24 hours for Field 2 to occur from the start of the time that field 1 occurred  ? I was hoping to do this in the where clause.... 

 

| where Field1-Field2>1440 

 




Labels (2)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming that Field1 and Field2 are epoch times, Field2 (when the invite was received) should represent a time greater than Field1 (when the invite was sent) so the where clause should be be where Field2-Field1>1440. This also assumes you have converted the times to epoch-minutes by dividing by 60 since it is normally in seconds. It also assumes you have gathered the two times (Field1 and Field2) into the same event (if they are not already there).

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming that Field1 and Field2 are epoch times, Field2 (when the invite was received) should represent a time greater than Field1 (when the invite was sent) so the where clause should be be where Field2-Field1>1440. This also assumes you have converted the times to epoch-minutes by dividing by 60 since it is normally in seconds. It also assumes you have gathered the two times (Field1 and Field2) into the same event (if they are not already there).

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...