Splunk Search

compare time format

marellasunil
Communicator

Hi,
A job needs to be completed by 04:45 AM,
Can some one help me to extract time from the logs, compare 04:45 AM and send an alert.
Kindly help

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Mkay... assuming the field OSTIME is already extracted, do something like this:

... | rex field=OSTIME "(?<OS_hour>\d+):(?<OS_minute>\d+)" | eval too_late = if(OS_hour * 60 + OS_minute > 285, "yes", "no")

I'm not treating it as a date because you're not interested in the date, or the entire timestamp. You're just looking to compare the HH:MM portion to see if more than 285 minutes have elapsed since midnight. An alternative, approach using the entire timestamp would be this:

... | eval OSTIME_epoch = strptime(OSTIME, "%m/%d/%Y %H:%M:%S") | eval too_late = if((OSTIME_epoch - relative_time(OSTIME_epoch, "@d")) > (285*60), "yes", "no")

However, this may fail when combined with daylight savings changes... more or less time will have elapsed on those two days when it is 04:45.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Mkay... assuming the field OSTIME is already extracted, do something like this:

... | rex field=OSTIME "(?<OS_hour>\d+):(?<OS_minute>\d+)" | eval too_late = if(OS_hour * 60 + OS_minute > 285, "yes", "no")

I'm not treating it as a date because you're not interested in the date, or the entire timestamp. You're just looking to compare the HH:MM portion to see if more than 285 minutes have elapsed since midnight. An alternative, approach using the entire timestamp would be this:

... | eval OSTIME_epoch = strptime(OSTIME, "%m/%d/%Y %H:%M:%S") | eval too_late = if((OSTIME_epoch - relative_time(OSTIME_epoch, "@d")) > (285*60), "yes", "no")

However, this may fail when combined with daylight savings changes... more or less time will have elapsed on those two days when it is 04:45.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

It'd help if we knew what the time in your logs looked like.

0 Karma

marellasunil
Communicator

Hi Martin,
Thanks for your reply.

In the logs, we have OSTIME field. From OSTIME, we need to extract %H:%M.
Everyday this value need to compare with 04:45, to check the job is runningeven after 04:45 AM

The time format in logs looks like below
OSTIME="11/09/2015 06:05:00"

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...