Splunk Search

Error comparing Dates in Metadata search

sbsbb
Builder

I'm trying to compare the lastTime from a metadata search, with a relative time to now...

Unfortunatly the comparison doesn't work, I don't understand why

| metadata type=sources | search source=*kivdv.business.msg.* source=*dfi.in.log  | eval now=relative_time(now(),"-60d@d")  | eval last_gt_now=if(lastTime > now,"true","false") |   convert ctime(lastTime),ctime(now) |  table lastTime,now,last_gt_now,source

See screenshot, last_gt_now is always true !alt text

Tags (2)
0 Karma

kristian_kolb
Ultra Champion

Your search will show 'false' if a source hasn't produced any events in the past 60 days. For most cases, your sources will be more talkative than that, right? So 'true' would be the expected result. Looking at the timestamps in the table that the search produces, does this seem to be right?

At least I can get it to work in this fashion. However, you'll need an OR between the sources in the second element of the search query.

/K

somesoni2
SplunkTrust
SplunkTrust

Your search workes fine and provides false value as well for last_gt_now if lastTime is actually less than now.

0 Karma

kristian_kolb
Ultra Champion

sbsbb, yes. The screenshot shows all 'true' - as it should. All dates for last_gt_now are more recent than 60 days ago.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Running the query without the filter here gives me trues and falses correctly at the 60 day cutoff.

sbsbb
Builder

I'm sorry I've forgotten the screenshot... take a look at the results...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...