Spent all day trying to figure this out. The events I'm working with contain a field with an expiration date in Unix epoch time. I'm trying to bring up a table of events when current date is >= 30days before the expiration date. Combed through documentation and Splunk Answers no luck. Thanks in advance.
Example data:
expiration_date=1548910800000
Like this:
... | eval deltaDays = (now() - expiration_date)/86400 | where deltaDays>=30
Like this:
... | eval deltaDays = (now() - expiration_date)/86400 | where deltaDays>=30
Meant to write '<' instead of '>'. Its not giving events where now() is <= 30days of expiration_date
mysearch...
|eval now=now()
| eval deltaDays = (now() - expiration_date)/86400
| where deltaDays<=30
| table loginuid, token_serial, now, expiration_date
So did this work for you?
Sorry for late response was out for Thanksgiving. Hope you enjoyed yours!
I'm trying to test with this:
my search | eval deltaDays = (now() - expiration_date)/86400 | where deltaDays<=30 | eval expiration_date=expiration_date/1000 | eval Expiration_date=strftime(expiration_date,"%m/%d/%Y") | table loginuid, token_serial, Expiration_date
I expect to see events where the Expiration_date
field is <= 30 days from now()
but this is not the case. Am I using the where command correctly?
I did not look closely at your sample data and there is a problem there. It is neither in epoch, nor in any encoding that I can discern. If you can convert this to epoch, then my solution will work for you.
Even if I assume it is in milliseconds, this converts to Thu, 31 Jan 2019 05:00:00 GMT!
See if this gives you some ideas...
| eval dexpire=1548910800 | eval dback30=relative_time(ed, "-30d@d" ) | eval dnow=now() | table dexpire dback30 dnow | foreach d* [eval <>=strftime(<>, "%c")] | eval older=if(dnow>=dback30, "Y", "N")