Splunk Search

Time matching w/ a +/- 5 min window

cquinney
Communicator

Greetings Splunkers,

I have a lookup file that has a list of set jobs with a frequency timestamp (e.g. Mon-Fri @ 3:30) of when the job should be seen within Splunk.  I'm wanting to create an eval that will allow me to match the index time of an event/job with its frequency timestamp.

The dilemma I'm having is incorporating a +/- 5 min time span into the matching criteria.  Any assistance in figuring this out would be greatly appreciated.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust
| eval start=computedTime - 300, end=computedTime + 300
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The +/- 5 minute bit is easy - just add or subtract 300 seconds from the computed timestamp.  IMO, the hard part is converting "Mon-Fri @ 3:30" into a timestamp.

---
If this reply helps you, Karma would be appreciated.
0 Karma

cquinney
Communicator

Hi  @richgalloway ,

Can you possibly provide an example of how you'd incorporate your suggestion into the eval?  Thank you.

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
| eval start=computedTime - 300, end=computedTime + 300
---
If this reply helps you, Karma would be appreciated.
0 Karma

cquinney
Communicator

Hi @richgalloway 

Thank you for the advice, I ended up incorporating your suggestion into my query as such:

| eval TimeMatch=if(((_time >= _time-300 OR _time <= _time+300) AND _time=ExptectedTime), "Match", "No Match")

This gave me the results I was hoping for.  Thank you again!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...