Time duration filter

[jerinvarghese]

Hi All,

Need help in getting the data for those Downtime > 15 mins. below is the query am using.

index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown"
| fieldformat Time=strftime(Time,"%Y-%m-%d %l:%M:%S %p")
| sort- Time
| eval Downtime = tostring(now() - Time, "duration")
| rex field=Downtime "(?P<Downtime>[^.]+)"
| table Hostname Status Classification "Site Code", sitename, Time Downtime

output: 

Device name

Down

Bronze

LHC

Luanda

2020-08-05 2:02:40 PM

00:14:45

[richgalloway]

You have a search and you have results. What is the problem?

[jerinvarghese]

HI Rich, the data is for everything that appears in my tool. But i want a hold down timer of 15 mins.

i tried using below commands but that didn't worked.

| where Downtime >900

Also tried below

| where duration>900

but am not getting a data while adding this query. 

[richgalloway · Accepted solution]

OK.  I thought that might be the case, but it wasn't stated.

The clauses you tried won't work because they're comparing strings to integers.  You must compare numbers to numbers.

index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown"
| fieldformat Time=strftime(Time,"%Y-%m-%d %l:%M:%S %p")
| sort- Time
| eval Downtime = now() - Time
| where Downtime > 900
| fieldformat Downtime = tostring(Downtime, "duration")
| rex field=Downtime "(?P<Downtime>[^.]+)"
| table Hostname Status Classification "Site Code", sitename, Time Downtime