Splunk Search

How to search for an event from last week based on time value field?

vnguyen46
Contributor

Hi - I am searching for events based on time field Last_Login_Time (sample value: 2019-06-13T20:26:12.000Z) which happened in last one week.
In SQL, it can be Last_Login_Time > getdate() - 7. How it works in Splunk?

Tags (2)
0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Please try below query.

<yourBaseSearch>
| eval llt_epoch = strptime(Last_login_time, "%Y-%m-%dT%H:%M:%S.%3Q")
| where llt_epoch > now()-604800

View solution in original post

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Please try below query.

<yourBaseSearch>
| eval llt_epoch = strptime(Last_login_time, "%Y-%m-%dT%H:%M:%S.%3Q")
| where llt_epoch > now()-604800
0 Karma

vnguyen46
Contributor

Works perfectly. Script by VatsalJagani should work as well. Thank you!

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Hello @vnguyen46,

You can write say the similar thing in Splunk also. | where Last_Login_Time > relative_time(now(),"-7d")

Make sure your field Last_Login_Time is in epoch format (integer). If it is not in epoch format, instead it is in string then you can convert to epoch format like: | eval Last_Login_Time=strptime(Last_Login_Time,"%Y-%m-%dT%H:%M:%S.%3Q").

In comparison SQL, you need to run this search in "All Time". But in Splunk if you know that some event for which Last Login Time is in last 7 days event can be in Last 10 days not before that, then you can reduce the timerange to Last 10 Days to help Splunk complete search quicker. Or if you know value we are finding for event cannot be before last 7 days then you can say timerange to Last 7 Days.

Hope this helps!!!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...