Finding the hosts who time difference is 1hr to 10hrs ?

[kteng2024]

Hi,

i want to print the hosts,Time difference whose lastTime and recentTime is between 1hr to 10hrs . Below is the query i came up with, but it is not working. Can some one please help me with this ?

| metadata index=xyz type=hosts | eval difference = if((lastTime – recentTime) >=1 OR <= 10, hosts,”no hosts” | table hosts,difference

Thanks

[martin_mueller]

lastTime and recentTime are epoch timestamps with second resolution, comparing with 1 and 10 is looking for between 1 and 10 seconds. Using OR would always yield true, any number is "greater than one or less than ten". Additionally, the part after the OR has nothing to compare the ten with.

Try this:

| metadata ... | eval hours = (lastTime - recentTime)/3600 | where hours >=1 AND hours <= 10 | table host hours

Note, you likely want (recentTime - lastTime) instead of (lastTime - recentTime), unless your environment is weird.

[martin_mueller]

One is "A minus B", the other is "B minus A" - the difference between the two will be whether you get positive or negative values.

It depends on what you're looking for - hosts with old data arriving now, or hosts with future data arriving now.

[kteng2024]

can i please know the difference between (recentTime - lastTime) & (lastTime - recentTime) because when data is streaming both the field values are equal.