Splunk Search

To find requests which are late by 1 day

Contributor

Hi I have a query where i am retrieving the logs which have timestamp>field.

eg: ....| where _time>RequestActual
RequestActual is a field extracted from logs, which has the exact time by which it should have been received

so the above search ideally reports the requests which were received after the actual time specified in logs.

Now my question is how to get requests which are more than 1 day late.

i.e what query should i use to get logs
..| where _time>(RequestActual+1day)

please help me with this.

Tags (2)
0 Karma
1 Solution

Ultra Champion

Well, does this mean that you have two timestamps in your logs? In most cases Splunk will interpret the timestamp inside the event and set _time to this value, even if it differs a little from the system clock on the indexer.

If you have a second timestamp in the event (or if Splunk uses its system clock for setting _time), you may have a difference between the two do your calculations on.

If the second timestamp (i.e. the one differing from the index time) is NOT in epoch, you'll have to convert it using eval RequestActualEpoch=strptime(RequestActual, <your format here>) Please see the following places for help with this:

http://docs.splunk.com/Documentation/Splunk/4.2.3/SearchReference/CommonEvalFunctions
http://www.tutorialspoint.com/python/time_strptime.htm

Then, when you have both of the times in epoch, you can do a search for events that are more than one day late as;

...|where (_time - RequestActualEpoch) > 86400

Hope this helps,

Kristian

View solution in original post

Ultra Champion

Well, does this mean that you have two timestamps in your logs? In most cases Splunk will interpret the timestamp inside the event and set _time to this value, even if it differs a little from the system clock on the indexer.

If you have a second timestamp in the event (or if Splunk uses its system clock for setting _time), you may have a difference between the two do your calculations on.

If the second timestamp (i.e. the one differing from the index time) is NOT in epoch, you'll have to convert it using eval RequestActualEpoch=strptime(RequestActual, <your format here>) Please see the following places for help with this:

http://docs.splunk.com/Documentation/Splunk/4.2.3/SearchReference/CommonEvalFunctions
http://www.tutorialspoint.com/python/time_strptime.htm

Then, when you have both of the times in epoch, you can do a search for events that are more than one day late as;

...|where (_time - RequestActualEpoch) > 86400

Hope this helps,

Kristian

View solution in original post

Contributor

thanks a lot..this kind of helps...

0 Karma

Motivator

Is the index _time equal to the RequestActual time?

if so you could narrow your time like for example:
earliest=-2d@d latest=-1d@d "your search query".

earliest=-2d@d latest=-1d@d sourcetype="ABC"|stats count(RequestActual) as Number_of_Request.

If you need more information read the following document:

http://docs.splunk.com/Documentation/Splunk/latest/User/ChangeTheTimeRangeOfYourSearch

0 Karma

Legend

_time is in epoch format. Which format is the RequestActual field in?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!