Splunk Search

how do I clac time out using eval

SasiB137
Engager

in,out,name
05-06-2015 11:37:04,05-06-2015 11:37:04 ,uid2
05-06-2015 11:36:06,,uid2

how do I do this,
If out time is not in the event and
OUT time > (current_time + 1hr) then mark status as TIMEOUT

lets say now is 05-06-2015 12:47:00 then expected output should be as

==================================
in,out,name
05-06-2015 11:37:04,05-06-2015 11:37:04 ,uid2 -> expected is -> LOGOUT

05-06-2015 11:36:06,,uid2 -> TIMEOUT

Tags (4)
0 Karma
1 Solution

woodcock
Esteemed Legend

Based on your comment:

OUT time > (current_time + 1hr) then mark status as TIMEOUT else 'ACTIVE'

This is the search (but it doesn't make any sense to me because now event should "happen after" now()):

... | eval outEpoch= strptime(out, "%m-%d-%Y %H:%M:%S") | eval status=if(outEpoch > (now() + 60*60), "TIMEOUT", "ACTIVE")

View solution in original post

0 Karma

woodcock
Esteemed Legend

Based on your comment:

OUT time > (current_time + 1hr) then mark status as TIMEOUT else 'ACTIVE'

This is the search (but it doesn't make any sense to me because now event should "happen after" now()):

... | eval outEpoch= strptime(out, "%m-%d-%Y %H:%M:%S") | eval status=if(outEpoch > (now() + 60*60), "TIMEOUT", "ACTIVE")
0 Karma

woodcock
Esteemed Legend

Like this (probably not exactly what you need but I am having trouble comprehending your example; this should get you started anyway):

... | eval status=if(isnull(out), "TIMEOUT", "LOGOUT") | table in out name status
0 Karma

SasiB137
Engager

OUT time > (current_time + 1hr) then mark status as TIMEOUT else 'ACTIVE'

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...