Skip to content

Instantly share code, notes, and snippets.

@jhg03a

jhg03a/Splunk relative time lookup

Created September 16, 2016 18:12
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save jhg03a/d3ba0c049c21bf31e9913dc29355c6c7 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save jhg03a/d3ba0c049c21bf31e9913dc29355c6c7 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Splunk relative time lookup
| inputlookup mykvstore
| eval _time=strptime(LastUpdate , "%m/%d/%Y %H:%M:%S")
| where _time < relative_time(now(),"-3d")
| eval Keyfield=_key
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment