Splunk Search

about date and time form

crazyeva
Contributor

There are "date-time" fields other than _time in events:
...^2012/06/30 23:58:20^2012/06/30 23:58:20...
we pre extracted them as "firsttime","lasttime"
we want the results where (fisttime-lasttime)<300s, how could we approach that?
I have tried search as:
| rex field=firsttime "(?\d{2}/\d{2}/\d{2})\s(?\d{2}:\d{2}:\d{2})"
| rex field=lasttime "(?\d{2}/\d{2}/\d{2})\s(?\d{2}:\d{2}:\d{2})"
| convert dur2sec(ftime), dur2sec(ltime)
| where fdate=ldate | eval duration=ltime-ftime |where duration<300 |
but this is not impeccable.

Edit:
Hi
This solution so cool
But it seems not willing to work, I dont know what I did wrong:

sourcetype="..." | fields FirstOccurrence LastOccurrence
| eval firsttime_epoch=strptime(FirstOccurrence,"%Y/%m/%d %H:%M:%S")
| eval lasttime_epoch=strptime(LastOccurrence,"%Y/%m/%d %H:%M:%S")
| table FirstOccurrence firsttime_epoch There are values in FirstOccurrence but firsttime_epoch not
one of samples:
1/10/11 12:08:58

(just now)

Tags (1)
0 Karma
1 Solution

Ayn
Legend

A better way would probably be to use eval's strptime function to convert the timestamp strings to epoch values and then use these in your comparison.

... | eval firsttime_epoch=strptime(firsttime,"%Y/%m/%d %H:%M:%S")
| eval lasttime_epoch=strptime(lasttime,"%Y/%m/%d %H:%M:%S")
| where lasttime_epoch-firsttime_epoch<300

View solution in original post

0 Karma

crazyeva
Contributor

Thank you again
| eval firsttime_epoch=strptime(FirstOccurrence,"%Y-%m-%d %H:%M:%S")
| eval lasttime_epoch=strptime(LastOccurrence,"%Y-%m-%d %H:%M:%S")
| eval firsttime_epoch2=strptime(FirstOccurrence,"%m/%d/%y %H:%M:%S")
| eval lasttime_epoch2=strptime(LastOccurrence,"%m/%d/%y %H:%M:%S")
| where lasttime_epoch-firsttime_epoch<300 OR lasttime_epoch2-firsttime_epoch2<300
then it works

0 Karma

Ayn
Legend

The sample you provided has another date format than what you posted in earlier events, so if that's the format you're working with you should change the strptime format string to reflect that.

0 Karma

Ayn
Legend

A better way would probably be to use eval's strptime function to convert the timestamp strings to epoch values and then use these in your comparison.

... | eval firsttime_epoch=strptime(firsttime,"%Y/%m/%d %H:%M:%S")
| eval lasttime_epoch=strptime(lasttime,"%Y/%m/%d %H:%M:%S")
| where lasttime_epoch-firsttime_epoch<300
0 Karma

crazyeva
Contributor

Thank you very much !
That is professional

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...