Splunk Search

How to get search data to be more than 12 months old?

Jay1234
Explorer

I am trying to run a search where I want my data to be more than 12 months old.
However when I run this search, it brings up data between 2 days old and 12 months old.

Anyone got any ideas on where I am going wrong?

| inputlookup append=T access_tracker where lastTime_user>=1659602543.000000
| stats min(firstTime) as firstTime,values(second2lastTime) as second2lastTime,values(lastTime) as lastTime_vals,max(lastTime) as lastTime by user
| eval "second2lastTime"=mvdedup(mvappend('second2lastTime',NULL,'lastTime_vals')),"second2lastTime"=if(mvcount('lastTime')=1 AND mvcount('second2lastTime')>1 AND 'second2lastTime'='lastTime',split(ltrim(replace("|".mvjoin('second2lastTime',"|"),"\|".'lastTime',""),"|"), "|"),'second2lastTime'),"second2lastTime"=max('second2lastTime'),inactiveDays=round((lastTime-second2lastTime)/86400,2),_time=lastTime
| search inactiveDays>=12mo

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

With timestamps, values greater than a certain value are more recent (newer).  To find event older than a certain time, use less than.

lastTime_user<=1659602543.000000
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...