Splunk Search

eval strftime search assistance

bzsplunk54
New Member

Hello,

I’m hoping for some suggestions for the process that I am trying to accomplish. I have a universal forwarder setup to ingest a _json file of which includes a complete network inventory. This inventory.json file is populated by GET processing from our ACS system. This process pulls in all active equipment and populates the .json file on a nightly basis. We do not purge the json file regularly as we want to be able to recall comparison data over time for number-based management processes. If a device is removed from the network or if the device is offline for some reason it still will be visible within the inventory.json file. Currently I am running the below and flagging a ‘last access’ element and putting that against the eval with strftime. This presents me with the devices that have been online over the past day and does not show if a device is currently offline or has been removed from the network as I only want current information, and this works for me.

earliest =-0d@d latest=now
| eval seen=strftime(last_access, "%T %F, %Z")

OBJECTIVE:
I need to be able to have the strftime review the last 5 days however only display one entry with that entry being the lastest. So if I am looking at this inventory.json file on Friday I also want to be shown the device if it was online Wednesday but currently not today.

Tags (3)
0 Karma

cmerriman
Super Champion

can't you just change the earliest to earliest=-5d@d to look at the last 5 days of data?
you can use a few evals to see if it was last seen today and other last seen dates

   | eval last_seen=strftime(last_access, "%T %F, %Z")
|eval last_seen_today=if(last_access>=relative_time(now(),"@d"),last_seen,null())
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...