Splunk Search

Pulling 1-day old records

vnguyen46
Contributor

Hi,

Let say I have field lastTime (sample value lastTime = 09/01/2019 11:52:31). There are records with lastTime reported > 1 day (24 hours) that I'd like to set the alert on. Is there a way I can pull these records?

Thanks,

Tags (2)
0 Karma
1 Solution

vnguyen46
Contributor

Hi richgalloway - thanks again for giving help. I found an answer to another question and I think it's helpful:
... | eval ddate_epoch = strptime(ddate, "%Y-%m-%d %H:%M:%S") | eval diff_seconds = now() - ddate_epoch | eval diff_days = diff_seconds / 86400

In my case, if diff_days>1 triggering an alert.

View solution in original post

0 Karma

vnguyen46
Contributor

Hi richgalloway - thanks again for giving help. I found an answer to another question and I think it's helpful:
... | eval ddate_epoch = strptime(ddate, "%Y-%m-%d %H:%M:%S") | eval diff_seconds = now() - ddate_epoch | eval diff_days = diff_seconds / 86400

In my case, if diff_days>1 triggering an alert.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

vnguyen46
Contributor

thank you.

0 Karma

vnguyen46
Contributor

Thanks for helping. lastTime is a variable with value like 08/26/2019 11:20:01, but yes it can be the same as _time.
I mean 24 hr to the future. Let say: latencyTime = (now - lastTime) if latencyTime >24 hours, then fire the alert.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

So to clarify further, lastTime can be the same as _time, but not always?
You say 24 hours to the future, but your example SPL computes 24 hours in the past. Which is correct?

---
If this reply helps you, Karma would be appreciated.
0 Karma

KARANMALHOTRA
Path Finder

Are you trying to identify latency between the events getting generated and the time that they are indexed?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Is lastTime the same as _time? Are you looking for lastTime values more than 24 hours in the past or in the future?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...