Splunk Search

How can I compare static time value in a lookup field with current system time +/- 5 m?

donrtowery
New Member

I'm just learning splunk so sorry if this is a simple question. I have a lookup with a field that has static time values. How can I compare those static time values with the current system time, not including the date, just the time (plus or minute 5 minutes)?

0 Karma

somesoni2
Revered Legend

You can use now() function, which gives the current time , with relative_time function to compare those time values, something like this

| inputlookup yourlookup.csv | eval Result=if('YourTimeFieldInLookup'>=relative_time(now(),"-5m") OR 'YourTimeFieldInLookup'<=relative_time(now(),"+5m"),"WithinRange","OutsideRange")
0 Karma

donrtowery
New Member

this is close, i'm evaluating with the 'where' clause. I modified this a bit, it seems that its still evaluating the date in the current system time (now). I removed the because it was returning everything that had a value in the field. Is there a way to evaluate against the current system time without the date?

where time=relative_time(now(),"-5m") OR time=relative_time(now(),"+5m")
0 Karma

donrtowery
New Member

and I just realized it doesnt need to evaluate 5 minutes into the future, dunno what i was thinking there.

 where time=relative_time(now(),"-5m")
0 Karma
Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...