Splunk Search

time difference of events

msachdeva3
Explorer

eval test_time = time() - _time | search (test_time > 1800 AND test_time < 86400)|

I'm trying to see if the events in my logs(when i run query should be more than 30 mins & less than 24 hrs old) from the time they logged?

is the condition right?

Tags (1)
0 Karma

DalJeanis
Legend

gpradeepkumarreddy's answer is probably the most useful way to do that.

If you wanted to do it in code, your code is close to correct as far as it goes, since epoch time is calculated in seconds. However, you probably want to use the now() function rather than time(), since it will give a single result for the entire search, as opposed to being calculated at a different microsecond for each event.

0 Karma

pradeepkumarg
Influencer

You can use the time picker or mention earliest and latest as below in your search


earliest=-24h latest=-30m

Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...