How to find the time difference between the event and the current time?

[alexspunkshell]

I have " threatInfo.updatedAt" information in my logs.

I want to get an alert if the time difference between "threatInfo.updatedAt" & "_time" is more than 4 hours.

My Search Query

index=test "file_name"=* "threatInfo.incidentStatus"=unresolved |transaction threatInfo.updatedAt | table _time threatInfo.updatedAt file_name file_path category

[PickleRick]

| eval updatedat=strptime(threatInfo.updatedAt,"i never remember those formats ;)")
| where abs(_time-updatedat)<4*3600

I really can never remember those time format specifiers. 

[isoutamo]

Link to those: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables

In your case: "%Y-%m-%dT%H:%M:%S.%6Q%Z" or same in shorter format "%FT%T.%6Q%Z"

r. Ismo

[PickleRick]

Thanks. 🙂 As usual, I was typing it on my tablet and it's very inconvenient to switch between different tabs there.