Splunk Search

get latest time stamp from two timestamps

Dassari
New Member

HI I have two time stamps like "2017-01-30T19:22:39Z" "2017-01-29T19:17:33Z"
From the above two timestamps I wan to get latest timestamp i.e 2017-01-30T19:22:39Z, please help me

Tags (1)
0 Karma

varad_joshi
Communicator

How about this.
Convert them in epoch time and then do the selection with an IF clause. Select whichever is larger.

Just shared the logic, see if that works for you.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this.

... | eval LatestTS = if(strptime(TS1,"%Y-%m-%dT%H:%M:%S%Z")>strptime(TS2,"%Y-%m-%dT%H:%M:%S%Z"), TS1, TS2) | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

varad_joshi
Communicator

haha you beat me with few seconds there, and you posted the exact query. Yes, this should work for the OP.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...