Splunk Search

How to find the time difference between the event and the current time?


I have " threatInfo.updatedAt" information in my logs.

I want to get an alert if the time difference between "threatInfo.updatedAt" & "_time" is more than 4 hours.


My Search Query

index=test "file_name"=* "threatInfo.incidentStatus"=unresolved |transaction threatInfo.updatedAt | table _time threatInfo.updatedAt file_name file_path category




Labels (4)
Tags (1)
0 Karma

Ultra Champion
| eval updatedat=strptime(threatInfo.updatedAt,"i never remember those formats ;)")
| where abs(_time-updatedat)<4*3600

I really can never remember those time format specifiers. 

0 Karma


Link to those: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables

In your case: "%Y-%m-%dT%H:%M:%S.%6Q%Z" or same in shorter format "%FT%T.%6Q%Z"

r. Ismo

Ultra Champion

Thanks. 🙂 As usual, I was typing it on my tablet and it's very inconvenient to switch between different tabs there.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...