topic Re: Compare usual time to Epoch time in Splunk Enterprise

Compare usual time to Epoch time

luckyman80 — Thu, 07 Oct 2021 09:56:02 GMT

Hi Experts! ,

Wondered if there was a way of doing this. I have a need to compare a timestamp of a log to an EPOCH time also on the same log line and show the Diff

Example

2021-10-05 04:49:10.138 [pool-1-thread-1] INFO order - [Pool]Book={inst=example,1=[],2=[feed-|time=1633427347600000000}

Manually looking the difference is

2021-10-05 04:49:10.138 -(Standard time)

2021-10-05 04:49:07.600 -(EPOCH time)

Difference 2.54 seconds

Thanks in advance

Re: Compare usual time to Epoch time

ITWhisperer — Thu, 07 Oct 2021 10:43:11 GMT

Is your "standard" time already extracted as _time?

Your EPOCH time looks like it might be in nano-seconds, so try

| eval diff=_time-(epoch/1000000000)

Re: Compare usual time to Epoch time

luckyman80 — Thu, 07 Oct 2021 10:55:26 GMT

Hi! Thanks for the quick response! I haven't Extracted time yet (not sure how to do that) also how do I display it after ? sorry for all the questions

Re: Compare usual time to Epoch time

ITWhisperer — Thu, 07 Oct 2021 10:58:22 GMT

You may find it has already been extracted for you when the events were indexed. What fields do you have extracted?

Re: Compare usual time to Epoch time

luckyman80 — Thu, 07 Oct 2021 12:10:43 GMT

Apols if im being stupid . I tried

| eval diff=_time-(epoch/1000000000)|table diff

but dont see anything

Re: Compare usual time to Epoch time

ITWhisperer — Thu, 07 Oct 2021 12:17:43 GMT

What do you get if you just do

<<your search>> | table _time epoch

Re: Compare usual time to Epoch time

luckyman80 — Thu, 07 Oct 2021 15:04:25 GMT

_time looks like this

2021-10-07 08:28:04.211

epoch column is blank

Re: Compare usual time to Epoch time

somesoni2 — Thu, 07 Oct 2021 15:56:55 GMT

Try this

Your base search| eva diff=_time-time | table diff

Re: Compare usual time to Epoch time

luckyman80 — Thu, 07 Oct 2021 16:31:34 GMT

i did try that .. now I get
_time as 2021-10-07 12:30:03.839

and diff as -1633624103220375800.000

Re: Compare usual time to Epoch time

ITWhisperer — Thu, 07 Oct 2021 16:52:43 GMT

OK extract epoch like this

| rex "time=(?<epoch>\d*)"

Re: Compare usual time to Epoch time

somesoni2 — Thu, 07 Oct 2021 18:34:47 GMT

Try this

Your base search | eval diff=abs(_time-(time/1000000000))

Re: Compare usual time to Epoch time

luckyman80 — Thu, 07 Oct 2021 20:06:28 GMT

thank you ! worked great