I have a log by the name of auditlog, which logs accountNumber AND accountCreateDt
accountCreateDt = %Y-%m-%d format.
I am trying to identify Accounts that were created less than 24 hours ago by executing this search.
sourcetype="auditlog" | convert timeformat="%Y-%m-%d" mktime(accountCreateDt) as lastTime | convert mktime(_time) as c_time | eval Diff=c_time - lastTime | where Diff < 86400 | table accountNumber
For some reason, this query is not working.
IF i replace the last query with | table Diff
it works like a charm (it gives me all time difference as long as account was created less than 24 hours ago).
Am i not using eval and table correctly ?
It looks mostly okay, but I think you are doing it the hard way:
sourcetype=auditlog
| eval lastTime = strptime(accountCreateDt,"%Y-%m-%d")
| where lastTime > relative_time(now(), "-24h")
| table accountNumber accountCreateDt
One of the variables that you are using is _time
- that is the the timestamp of the event; it will vary with each event. now()
is the starting time of the search. I think that now()
is what you should be using here, no matter how you choose to calculate things.
It looks mostly okay, but I think you are doing it the hard way:
sourcetype=auditlog
| eval lastTime = strptime(accountCreateDt,"%Y-%m-%d")
| where lastTime > relative_time(now(), "-24h")
| table accountNumber accountCreateDt
One of the variables that you are using is _time
- that is the the timestamp of the event; it will vary with each event. now()
is the starting time of the search. I think that now()
is what you should be using here, no matter how you choose to calculate things.
I like the idea of using now() more than _time.
Also this is a much simpler solution