Mkay... assuming the field OSTIME is already extracted, do something like this:
... | rex field=OSTIME "(?<OS_hour>\d+):(?<OS_minute>\d+)" | eval too_late = if(OS_hour * 60 + OS_minute > 285, "yes", "no")
I'm not treating it as a date because you're not interested in the date, or the entire timestamp. You're just looking to compare the HH:MM portion to see if more than 285 minutes have elapsed since midnight. An alternative, approach using the entire timestamp would be this:
... | eval OSTIME_epoch = strptime(OSTIME, "%m/%d/%Y %H:%M:%S") | eval too_late = if((OSTIME_epoch - relative_time(OSTIME_epoch, "@d")) > (285*60), "yes", "no")
However, this may fail when combined with daylight savings changes... more or less time will have elapsed on those two days when it is 04:45.
... View more