eval strftime search assistance

[bzsplunk54]

Hello,

I’m hoping for some suggestions for the process that I am trying to accomplish. I have a universal forwarder setup to ingest a _json file of which includes a complete network inventory. This inventory.json file is populated by GET processing from our ACS system. This process pulls in all active equipment and populates the .json file on a nightly basis. We do not purge the json file regularly as we want to be able to recall comparison data over time for number-based management processes. If a device is removed from the network or if the device is offline for some reason it still will be visible within the inventory.json file. Currently I am running the below and flagging a ‘last access’ element and putting that against the eval with strftime. This presents me with the devices that have been online over the past day and does not show if a device is currently offline or has been removed from the network as I only want current information, and this works for me.

earliest =-0d@d latest=now
| eval seen=strftime(last_access, "%T %F, %Z")

OBJECTIVE:
I need to be able to have the strftime review the last 5 days however only display one entry with that entry being the lastest. So if I am looking at this inventory.json file on Friday I also want to be shown the device if it was online Wednesday but currently not today.

[cmerriman]

can't you just change the earliest to earliest=-5d@d to look at the last 5 days of data?
you can use a few evals to see if it was last seen today and other last seen dates

   | eval last_seen=strftime(last_access, "%T %F, %Z")
|eval last_seen_today=if(last_access>=relative_time(now(),"@d"),last_seen,null())