Splunk Search

have to less 10 minutes from a timestamp when another field value is null

pench2k19
Explorer

Hi Team,

I have two fields named as file arrival time , Sla time . I have to list the no files that are going to violate the SLA time in 10 mins.

I mean when the file arrival time is null value i have to less 10 mins from Sla time and print the corresponding file names that are going to violate the SLA time.

can you help me out in this use case

@vnravikumar @jkat54

Tags (1)
0 Karma

DMohn
Motivator

You could eval a new field, e.g. violation_time, which can be populated either as SLA time, or SLA time - 10 mins ...

| eval violation_time=if(isnull(file_arrival_time),relative_time(sla_time,"-10m"),sla_time))

This said, you have to make sure, that sla_time in this case is a timestamp field. If needed, you could eval that field as well with the strptime command.

If you need further assistance, feel free to comment!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...