Using eval with table

[asarolkar]

I have a log by the name of auditlog, which logs accountNumber AND accountCreateDt

accountCreateDt = %Y-%m-%d format.

I am trying to identify Accounts that were created less than 24 hours ago by executing this search.

sourcetype="auditlog" | convert timeformat="%Y-%m-%d" mktime(accountCreateDt) as lastTime | convert mktime(_time) as c_time | eval Diff=c_time - lastTime | where Diff < 86400 | table accountNumber 

For some reason, this query is not working.

IF i replace the last query with | table Diff it works like a charm (it gives me all time difference as long as account was created less than 24 hours ago).

Am i not using eval and table correctly ?

[lguinn2 · Accepted solution]

It looks mostly okay, but I think you are doing it the hard way:

sourcetype=auditlog
| eval lastTime = strptime(accountCreateDt,"%Y-%m-%d")
| where lastTime > relative_time(now(), "-24h")
| table accountNumber accountCreateDt

One of the variables that you are using is _time - that is the the timestamp of the event; it will vary with each event. now() is the starting time of the search. I think that now() is what you should be using here, no matter how you choose to calculate things.

[asarolkar]

I like the idea of using now() more than _time.

Also this is a much simpler solution