time compare

[chaitup]

Hi Guys,
We have a scheduled PowerShell script which will give the output in a log file which will have a status of “LastDirSyncTime” time in UTC time as below on every 15 minutes.

LastDirSyncTime : 08-11-2019 07:35:17

Now our requirement is;
Compare the LastDirSyncTime (which is in UTC) with my Splunk Computer’s current time (Which is in PST) and provide the time difference. Our main goal is to trigger an alert in Splunk when ever “LastDirSyncTime” is more than 30 minutes.
Can some one please provide me a query to extract the time difference in minutes so that we can configure the required alerts.

[woodcock]

Like this:

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo"
| stats max(_time) AS _time BY host
| eval age = now() - _time
| where age >= (30 * 60)

This will work fine if you were not lazy and you used the LastDirSyncTime as your event's _time. If you did not, then you will have to do it like this:

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo"
| stats latest(LastDirSyncTime) AS _time BY host
| eval _time = strptime(_time, "%m-%d-%Y %H:%M:%S")
| eval age = now() - _time
| where age >= (30 * 60)

[richgalloway]

To compare timestamps they must first be converted to epoch (integer) form. Then you can subtract them to get the difference in seconds. From there, simple math should get you the desired result.

... | eval eLastDirSyncTime=strptime(LastDirSyncTime, "%d-%m-%Y %H:%M:%S")
| eval diffMin = (now() - eLastDirSyncTime) / 60