I have " threatInfo.updatedAt" information in my logs.
I want to get an alert if the time difference between "threatInfo.updatedAt" & "_time" is more than 4 hours.
My Search Query
index=test "file_name"=* "threatInfo.incidentStatus"=unresolved |transaction threatInfo.updatedAt | table _time threatInfo.updatedAt file_name file_path category
| eval updatedat=strptime(threatInfo.updatedAt,"i never remember those formats ;)")
| where abs(_time-updatedat)<4*3600
I really can never remember those time format specifiers.
Link to those: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables
In your case: "%Y-%m-%dT%H:%M:%S.%6Q%Z" or same in shorter format "%FT%T.%6Q%Z"
r. Ismo
Thanks. 🙂 As usual, I was typing it on my tablet and it's very inconvenient to switch between different tabs there.