Splunk Search

How to filter time through where clause

MeMilo09
Path Finder

Hello All, 

Thought I had this down, but not quite. So here is the scenario. I have two Fields  1. "Sent Invite Time"  and 2. "Received Invite Time". Received Invite Time should happen 1440 min from the time "Sent Invite Time occurred" and then searching for when the duration it took between those two fields is over 1440 in min. 

The problem I have is that I am getting fields that are coming up as Not Received Invite this is because its not giving Field 2 "Received Invite Time" 1440 min to complete. So how can I do that - have Field 1"Sent Invite Time"  and give it 24 hours for Field 2 to occur from the start of the time that field 1 occurred  ? I was hoping to do this in the where clause.... 

 

| where Field1-Field2>1440 

 




Labels (2)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming that Field1 and Field2 are epoch times, Field2 (when the invite was received) should represent a time greater than Field1 (when the invite was sent) so the where clause should be be where Field2-Field1>1440. This also assumes you have converted the times to epoch-minutes by dividing by 60 since it is normally in seconds. It also assumes you have gathered the two times (Field1 and Field2) into the same event (if they are not already there).

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming that Field1 and Field2 are epoch times, Field2 (when the invite was received) should represent a time greater than Field1 (when the invite was sent) so the where clause should be be where Field2-Field1>1440. This also assumes you have converted the times to epoch-minutes by dividing by 60 since it is normally in seconds. It also assumes you have gathered the two times (Field1 and Field2) into the same event (if they are not already there).

0 Karma
Get Updates on the Splunk Community!

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...