Splunk Search

compare time format

marellasunil
Communicator

Hi,
A job needs to be completed by 04:45 AM,
Can some one help me to extract time from the logs, compare 04:45 AM and send an alert.
Kindly help

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Mkay... assuming the field OSTIME is already extracted, do something like this:

... | rex field=OSTIME "(?<OS_hour>\d+):(?<OS_minute>\d+)" | eval too_late = if(OS_hour * 60 + OS_minute > 285, "yes", "no")

I'm not treating it as a date because you're not interested in the date, or the entire timestamp. You're just looking to compare the HH:MM portion to see if more than 285 minutes have elapsed since midnight. An alternative, approach using the entire timestamp would be this:

... | eval OSTIME_epoch = strptime(OSTIME, "%m/%d/%Y %H:%M:%S") | eval too_late = if((OSTIME_epoch - relative_time(OSTIME_epoch, "@d")) > (285*60), "yes", "no")

However, this may fail when combined with daylight savings changes... more or less time will have elapsed on those two days when it is 04:45.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Mkay... assuming the field OSTIME is already extracted, do something like this:

... | rex field=OSTIME "(?<OS_hour>\d+):(?<OS_minute>\d+)" | eval too_late = if(OS_hour * 60 + OS_minute > 285, "yes", "no")

I'm not treating it as a date because you're not interested in the date, or the entire timestamp. You're just looking to compare the HH:MM portion to see if more than 285 minutes have elapsed since midnight. An alternative, approach using the entire timestamp would be this:

... | eval OSTIME_epoch = strptime(OSTIME, "%m/%d/%Y %H:%M:%S") | eval too_late = if((OSTIME_epoch - relative_time(OSTIME_epoch, "@d")) > (285*60), "yes", "no")

However, this may fail when combined with daylight savings changes... more or less time will have elapsed on those two days when it is 04:45.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

It'd help if we knew what the time in your logs looked like.

0 Karma

marellasunil
Communicator

Hi Martin,
Thanks for your reply.

In the logs, we have OSTIME field. From OSTIME, we need to extract %H:%M.
Everyday this value need to compare with 04:45, to check the job is runningeven after 04:45 AM

The time format in logs looks like below
OSTIME="11/09/2015 06:05:00"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...