Splunk Search

How to find a difference between two times which are off by two different formats and set an alert if the difference is more than 10mins?

sangs8788
Communicator

Hi,

I have a query which returns two columns Time1 which is _time and one more column Time 2 which is user calculated time available in the event as below,

alt text

Query used

index=data |eval GetdateTime = date + " " + gettime  | timechart span=5m last(GetdateTime) as Time2 by server

Query returns the last date logged in event by server. I have to identify difference between those two time fields which is _time & Time2. How do i find the difference since the format of the fields are different for hours section. _time uses : as separator where in the field available in the column is using . as separator. How do i replace it and then convert it to epochtime in order to find the difference ?

I need to define an alert in real time to check if there is a difference in field is more than 10 mins
Please let me know.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There is no need to convert _time as it is already in epoch form (it's automatically converted to text when displayed). Use the strptime function to convert time2 to an epoch then you can subtract the two times to find their difference.

index=data |eval GetdateTime = date + " " + gettime | eval Timediff=strptime(GetdateTime, "%Y-%m-%d %H.%M.%S") | where Timediff>600 | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

Hi @sangs8788. Did the answer below solve your question? If yes, please click “Accept” directly below the answer to resolve the post. If not, please comment with more information if you are still having issues. Thanks!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is no need to convert _time as it is already in epoch form (it's automatically converted to text when displayed). Use the strptime function to convert time2 to an epoch then you can subtract the two times to find their difference.

index=data |eval GetdateTime = date + " " + gettime | eval Timediff=strptime(GetdateTime, "%Y-%m-%d %H.%M.%S") | where Timediff>600 | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

rsokolova
Path Finder

Please explain how can you strip the time out of 2 epoch times together. Also how can you compare an epoch time result against a regular number ?

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...