applying current time multiple times (per specific event)

[PawelSplunk]

Hello Everyone

I'm trying to calculate the "time_difference" between one column and another in Splunk. The problem is that the value from which I substract something is current time and when I use the current time value it is shown in a table as one event (epoch_current_time). Therefore when I substract value "epoch_password_last_modified" from "epoch_current_time" i get no results. Is there a way to make "epoch_current_time" visible each time in each row like "epoch_password_last_modified" value?

[ITWhisperer · Accepted solution]

It looks like "epoch_password_last_modified" is a multivalue field; assuming you want to continue processing this a set of multivalue fields (although I think you might be better off expanding to individual events or not creating the multivalue fields in the first place), you could try something like this

| eval time_difference=mvmap(epoch_password_last_modified, epoch_current_time - epoch_password_last_modified)

[PawelSplunk]

Yes. Thank You very much. It works.