Hi, I'm trying to work out a way of adding the existing time to results produced by running the following macro;
| suppression_eventtypes
I'm currently pulling back the following fields;
| fields suppression, start_time, end_time
With the intention being to create some logic which will return any suppression's with an end_time 7 days from the current time. I can work out the logic needed, but am struggling to pull the current time back within the results as it's not produced as a field from the macro.
any ideas? Thanks.
@jacqu3sy, Based on the description seems like you need is relative_time()
function to give you the epoch time 7 days from current time i.e.
| eval EndTimeThreshold=relative_time(now(),"+7d@d")
Following is a run anywhere search to test your end_time
values (if it is string time the same needs to be converted to epoch time using strptime()
. If it is already epoch timem, then strptime()
is not required)
| makeresults
| eval end_time="2018/03/15"
| eval end_time=strptime(end_time,"%Y/%m/%d")
| eval EndTimeThreshold=relative_time(now(),"+7d@d")
| eval duration=EndTimeThreshold-end_time
| fieldformat EndTimeThreshold=strftime(EndTimeThreshold,"%Y/%m/%d %H:%M:%S")
| eval suppression=if(duration<=604800,"Within 7 Days","Outside 7 Days")
Please try out and confirm.
@jacqu3sy, Based on the description seems like you need is relative_time()
function to give you the epoch time 7 days from current time i.e.
| eval EndTimeThreshold=relative_time(now(),"+7d@d")
Following is a run anywhere search to test your end_time
values (if it is string time the same needs to be converted to epoch time using strptime()
. If it is already epoch timem, then strptime()
is not required)
| makeresults
| eval end_time="2018/03/15"
| eval end_time=strptime(end_time,"%Y/%m/%d")
| eval EndTimeThreshold=relative_time(now(),"+7d@d")
| eval duration=EndTimeThreshold-end_time
| fieldformat EndTimeThreshold=strftime(EndTimeThreshold,"%Y/%m/%d %H:%M:%S")
| eval suppression=if(duration<=604800,"Within 7 Days","Outside 7 Days")
Please try out and confirm.
Thats perfect. Many thanks.
@jacqu3sy, if your problem is resolved, please accept the answer to help future readers.
The current time is available from the now
function.
... | eval current_time=now() | ...
great, thanks.