To find requests which are late by 1 day

[adityapavan18]

Hi I have a query where i am retrieving the logs which have timestamp>field.

eg: ....| where _time>RequestActual
RequestActual is a field extracted from logs, which has the exact time by which it should have been received

so the above search ideally reports the requests which were received after the actual time specified in logs.

Now my question is how to get requests which are more than 1 day late.

i.e what query should i use to get logs
..| where _time>(RequestActual+1day)

please help me with this.

[kristian_kolb · Accepted solution]

Well, does this mean that you have two timestamps in your logs? In most cases Splunk will interpret the timestamp inside the event and set _time to this value, even if it differs a little from the system clock on the indexer.

If you have a second timestamp in the event (or if Splunk uses its system clock for setting _time), you may have a difference between the two do your calculations on.

If the second timestamp (i.e. the one differing from the index time) is NOT in epoch, you'll have to convert it using eval RequestActualEpoch=strptime(RequestActual, <your format here>) Please see the following places for help with this:

http://docs.splunk.com/Documentation/Splunk/4.2.3/SearchReference/CommonEvalFunctions
http://www.tutorialspoint.com/python/time_strptime.htm

Then, when you have both of the times in epoch, you can do a search for events that are more than one day late as;

...|where (_time - RequestActualEpoch) > 86400

Hope this helps,

Kristian

[adityapavan18]

thanks a lot..this kind of helps...

[lpolo]

Is the index _time equal to the RequestActual time?

if so you could narrow your time like for example:
earliest=-2d@d latest=-1d@d "your search query".

earliest=-2d@d latest=-1d@d sourcetype="ABC"|stats count(RequestActual) as Number_of_Request.

If you need more information read the following document:

http://docs.splunk.com/Documentation/Splunk/latest/User/ChangeTheTimeRangeOfYourSearch

[Ayn]

_time is in epoch format. Which format is the RequestActual field in?