Splunk Search

How to search for the time difference between last event and now?

alexspunkshell
Contributor

I have installedAt field which gives the application's installation time.

If I run a Splunk search for the last 7 days it shows the application installed at different times.

So I want the query to find the applications installed in the last 7 days.

alexspunkshell_1-1662371661439.png

 

 

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @alexspunkshell,

add, at the end of the search, a condition that excludes durations less than 7 days (604,800 seconds):

<your_search>
| eval duration=now()-strptime(InstalledAt,"%Y-%m-%dT%H:%M:%S.%6N")
| where duration>604800
| eval duration=tostring(duration,"duration")
| table _time InstalledAt duration

 Ciao.

Giuseppe

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You appear to have two different time formats in use - try something like this

| where now()-coalesce(strptime(installedAt,"%Y-%m-%dT%H:%M:%S.%6N%Z"),strptime(installedAt,"%Y-%m-%dT%H:%M:%S%Z")) < (60*60*24*7)

alexspunkshell
Contributor

@ITWhisperer @gcusello Tried using the queries. But no results.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @alexspunkshell,

there are two choices:

  • as @ITWhisperer said, there isn't any event,
  • check how it's written installedAt field name: field names are case sensitive.

Ciao.

Giuseppe

alexspunkshell
Contributor

@gcusello @ITWhisperer 

Though I gave | search duration <7+ condition, I am getting results other results. How to exclude the results within 7 days.

alexspunkshell_0-1662378568846.png

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @alexspunkshell,

add, at the end of the search, a condition that excludes durations less than 7 days (604,800 seconds):

<your_search>
| eval duration=now()-strptime(InstalledAt,"%Y-%m-%dT%H:%M:%S.%6N")
| where duration>604800
| eval duration=tostring(duration,"duration")
| table _time InstalledAt duration

 Ciao.

Giuseppe

ITWhisperer
SplunkTrust
SplunkTrust

Given that your example times are 4-5 years ago, could it be that you haven't had any installs in the last 7 days?

alexspunkshell
Contributor

@ITWhisperer @gcusello  I have new installs but the query is updating the latest time to all results and showing all the results. Here I need the installation that occurred over the past 7 days.

alexspunkshell_0-1662374944691.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The dedup will mean you will only get one result per agentComputerName - if you want the other dates, you should 

| dedup agentComputerName installedAt

gcusello
SplunkTrust
SplunkTrust

Hi @alexspunkshell,

you could run a search like the following:

<your_search>
| eval duration=tostring(now()-strptime(InstalledAt,"%Y-%m-%dT%H:%M:%S.%6N"),"duration")
| table _time InstalledAt duration

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...