Splunk Search

how to search events in the last 24 hours from a specified field

dboyer313
New Member

Hello - This should be a pretty simple search but I am new to Splunk.

I want to search events that have occurred in the last 24 hours according from the time stamp in the log field rather than the standard splunk presets. For example, my AV index has a found_date field with unique time stamps. How would I search those events based on the last 24 hours?

Thanks in advance!

Tags (1)
0 Karma

keshavkgupta
Observer

@gcusello

@dboyer313

 

I am having same issue. Not able to get any records when i use below query.

your_search earliest=-25h latest now 
| eval found_date=strptime(found_date,"your time format"), start_time=relative_time(now(),"-24h")
| search found_date>start_time
| ...

Please let me know if got an answer for this.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi dboyer313,
why don't you use found_date AS timestamp. it's easy to manage?
Anyway the problem is that you must set a Time period and you could have events with found_date in the last 24 hours and timestamp outside it, but at the same time, you cannot use a too large time period because your search will be very slow!
So you should try something like this:

your_search earliest=-25h latest now 
| eval found_date=strptime(found_date,"your time format"), start_time=relative_time(now(),"-24h")
| search found_date>start_time
| ...

I used -25h as time period, fixing that in the last 25 hours you have all the events with found_date in the last 24 hours, and this is to check.

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...