Splunk Search

Time stamp

smanojkumar
Contributor

Start_Time=092659
Start_Date=20220908

My requirement is to find the job amount many jobs that runs longer than a day, the above 2 fields relates the job start date and time, 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

If these fields are already strings, you can do something like this

| eval Start_Timestamp=strptime(Start_Date.Start_Time,"%Y%m%d%H%M%S")

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You will need more information than that - when does the job end? how are the events with the job start related to the events for the job end?

0 Karma

smanojkumar
Contributor

these jobs are currently running, so we won't have job end details.

I tried to compare with current time stamp (after converting current time to seconds) and if its greater than 86400 seconds, then the alert should trigger, but I'm having the field in separate for date and time (Start_Date , Start_Time), I'm not sure to club it and convert to seconds.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If these fields are already strings, you can do something like this

| eval Start_Timestamp=strptime(Start_Date.Start_Time,"%Y%m%d%H%M%S")
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...