Hi richgalloway - thanks again for giving help. I found an answer to another question and I think it's helpful:
... | eval ddate_epoch = strptime(ddate, "%Y-%m-%d %H:%M:%S") | eval diff_seconds = now() - ddate_epoch | eval diff_days = diff_seconds / 86400
In my case, if diff_days>1 triggering an alert.
Hi richgalloway - thanks again for giving help. I found an answer to another question and I think it's helpful:
... | eval ddate_epoch = strptime(ddate, "%Y-%m-%d %H:%M:%S") | eval diff_seconds = now() - ddate_epoch | eval diff_days = diff_seconds / 86400
In my case, if diff_days>1 triggering an alert.
If your problem is resolved, please accept the answer to help future readers.
thank you.
Thanks for helping. lastTime is a variable with value like 08/26/2019 11:20:01, but yes it can be the same as _time.
I mean 24 hr to the future. Let say: latencyTime = (now - lastTime) if latencyTime >24 hours, then fire the alert.
So to clarify further, lastTime can be the same as _time, but not always?
You say 24 hours to the future, but your example SPL computes 24 hours in the past. Which is correct?
Are you trying to identify latency between the events getting generated and the time that they are indexed?
Is lastTime the same as _time? Are you looking for lastTime values more than 24 hours in the past or in the future?