have to less 10 minutes from a timestamp when another field value is null

[pench2k19]

Hi Team,

I have two fields named as file arrival time , Sla time . I have to list the no files that are going to violate the SLA time in 10 mins.

I mean when the file arrival time is null value i have to less 10 mins from Sla time and print the corresponding file names that are going to violate the SLA time.

can you help me out in this use case

@vnravikumar @jkat54

[DMohn]

You could eval a new field, e.g. violation_time, which can be populated either as SLA time, or SLA time - 10 mins ...

| eval violation_time=if(isnull(file_arrival_time),relative_time(sla_time,"-10m"),sla_time))

This said, you have to make sure, that sla_time in this case is a timestamp field. If needed, you could eval that field as well with the strptime command.

If you need further assistance, feel free to comment!