Im pretty new to splunk, so my approach may be incorrect. However, At this time my query is as below:
search query
| eval pollingTime=strptime(requestDate,"%Y-%m-%d %H:%M:%S.%3N")
| eval drainingTime=strptime(receivedDate,"%Y-%m-%d %H:%M:%S.%3N")
| eval timeDiff=tostring((drainingTime-pollingTime),"duration")
| table requestDate receivedDate timeDiff
Which above Im able to obtain timeDiff value in the format (00:00:0.000000). If I want check wether the value us greater then a hour how should I go about doing this?
My thoughts were something like:
| eval isDelayed=if(timeDiff >= ? )
You can perform the evaluation before converting the variable to a string. For example:
...
| eval pollingTime=strptime(requestDate,"%Y-%m-%d %H:%M:%S.%3N")
| eval drainingTime=strptime(receivedDate,"%Y-%m-%d %H:%M:%S.%3N")
| eval timeDiff=(drainingTime-pollingTime)
| where timeDiff>3600
| eval timeDiff=tostring(timeDiff, "duration")
| table requestDate receivedDate timeDiff
If timeDiff
is greater than 3600 seconds (1 hour), then only those events will show up.
You can perform the evaluation before converting the variable to a string. For example:
...
| eval pollingTime=strptime(requestDate,"%Y-%m-%d %H:%M:%S.%3N")
| eval drainingTime=strptime(receivedDate,"%Y-%m-%d %H:%M:%S.%3N")
| eval timeDiff=(drainingTime-pollingTime)
| where timeDiff>3600
| eval timeDiff=tostring(timeDiff, "duration")
| table requestDate receivedDate timeDiff
If timeDiff
is greater than 3600 seconds (1 hour), then only those events will show up.
Thank you this works perfectly for me