Splunk Search

how to search events in the last 24 hours from a specified field

dboyer313
New Member

Hello - This should be a pretty simple search but I am new to Splunk.

I want to search events that have occurred in the last 24 hours according from the time stamp in the log field rather than the standard splunk presets. For example, my AV index has a found_date field with unique time stamps. How would I search those events based on the last 24 hours?

Thanks in advance!

Tags (1)
0 Karma

keshavkgupta
Observer

@gcusello

@dboyer313

 

I am having same issue. Not able to get any records when i use below query.

your_search earliest=-25h latest now 
| eval found_date=strptime(found_date,"your time format"), start_time=relative_time(now(),"-24h")
| search found_date>start_time
| ...

Please let me know if got an answer for this.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi dboyer313,
why don't you use found_date AS timestamp. it's easy to manage?
Anyway the problem is that you must set a Time period and you could have events with found_date in the last 24 hours and timestamp outside it, but at the same time, you cannot use a too large time period because your search will be very slow!
So you should try something like this:

your_search earliest=-25h latest now 
| eval found_date=strptime(found_date,"your time format"), start_time=relative_time(now(),"-24h")
| search found_date>start_time
| ...

I used -25h as time period, fixing that in the last 25 hours you have all the events with found_date in the last 24 hours, and this is to check.

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...