Splunk Search

How to filter time through where clause

MeMilo09
Path Finder

Hello All, 

Thought I had this down, but not quite. So here is the scenario. I have two Fields  1. "Sent Invite Time"  and 2. "Received Invite Time". Received Invite Time should happen 1440 min from the time "Sent Invite Time occurred" and then searching for when the duration it took between those two fields is over 1440 in min. 

The problem I have is that I am getting fields that are coming up as Not Received Invite this is because its not giving Field 2 "Received Invite Time" 1440 min to complete. So how can I do that - have Field 1"Sent Invite Time"  and give it 24 hours for Field 2 to occur from the start of the time that field 1 occurred  ? I was hoping to do this in the where clause.... 

 

| where Field1-Field2>1440 

 




Labels (2)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming that Field1 and Field2 are epoch times, Field2 (when the invite was received) should represent a time greater than Field1 (when the invite was sent) so the where clause should be be where Field2-Field1>1440. This also assumes you have converted the times to epoch-minutes by dividing by 60 since it is normally in seconds. It also assumes you have gathered the two times (Field1 and Field2) into the same event (if they are not already there).

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming that Field1 and Field2 are epoch times, Field2 (when the invite was received) should represent a time greater than Field1 (when the invite was sent) so the where clause should be be where Field2-Field1>1440. This also assumes you have converted the times to epoch-minutes by dividing by 60 since it is normally in seconds. It also assumes you have gathered the two times (Field1 and Field2) into the same event (if they are not already there).

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...