Splunk Search

Searching on time

robK123
Explorer

Hi,

I have a search that shows the last time a server last had a virus update but how can I make the search so it only shows machines that have not had a virus update for say 14 days?

Thanks,

Tags (1)
0 Karma
1 Solution

jonuwz
Influencer
... your search here | where last_update < now()-(14*24*60*60)

View solution in original post

0 Karma

jonuwz
Influencer
... your search here | where last_update < now()-(14*24*60*60)
0 Karma

jonuwz
Influencer

now() in eval returns the current epoch time, 14*24*60*60 is the number of seconds in 14 days.

So we're checking if the last_update was before that.

robK123
Explorer

Thanks can you break down what this bit of the search does

< now()-(14*24*60*60)

Thanks,

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...