Splunk Search

Search Condition

hxa27
Path Finder

Hi,

I have my search set and everything is work fine except the condition. In the search I have this condition in the end of my query search (where "Time Elapsed" > "03:00:00"), this condition does not work if it is like that and it shows all the file. However, if I have it like this( where TimeElapsed > "03:00:00"); it works just fine I don't know why??

Any idea

Thanks

Tags (1)
0 Karma

linu1988
Champion

then why "Time Elapsed" in where?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I see. In that case, where TimeElapsed > "something" is correct because that's the name of the field you're testing against. where "Time Elapsed" > "something" is comparing two strings with each other, and one is literally "Time Elapsed" rather than the value of the field.

A suggestion for rewriting that query, provided I understand what you're trying to achieve: Leave off the where entirely, and set the time range to not load events less than three hours old.

hxa27
Path Finder

This is my search query

index="test" sourcetype=NewIndex| eval timenew= now()- _time| eval TimeElapsed=tostring(timenew,"duration")|replace "C:\Users\hxa27\Desktop\NewIndexing\Test\" with ""|rename source as "File Name" |eval "File Create Date"=strftime(_time,"%m-%d-%Y %H:%M:%S")|table "File Name" TimeElapsed "File Create Date"

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Well, what's the name of the field you're testing the condition against?

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...