Splunk Search

Time matching w/ a +/- 5 min window

cquinney
Communicator

Greetings Splunkers,

I have a lookup file that has a list of set jobs with a frequency timestamp (e.g. Mon-Fri @ 3:30) of when the job should be seen within Splunk.  I'm wanting to create an eval that will allow me to match the index time of an event/job with its frequency timestamp.

The dilemma I'm having is incorporating a +/- 5 min time span into the matching criteria.  Any assistance in figuring this out would be greatly appreciated.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust
| eval start=computedTime - 300, end=computedTime + 300
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The +/- 5 minute bit is easy - just add or subtract 300 seconds from the computed timestamp.  IMO, the hard part is converting "Mon-Fri @ 3:30" into a timestamp.

---
If this reply helps you, Karma would be appreciated.
0 Karma

cquinney
Communicator

Hi  @richgalloway ,

Can you possibly provide an example of how you'd incorporate your suggestion into the eval?  Thank you.

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
| eval start=computedTime - 300, end=computedTime + 300
---
If this reply helps you, Karma would be appreciated.
0 Karma

cquinney
Communicator

Hi @richgalloway 

Thank you for the advice, I ended up incorporating your suggestion into my query as such:

| eval TimeMatch=if(((_time >= _time-300 OR _time <= _time+300) AND _time=ExptectedTime), "Match", "No Match")

This gave me the results I was hoping for.  Thank you again!

0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...