https://community.splunk.com/t5/Getting-Data-In/Time-conversion-amp-filter/m-p/563168#M100339 <P>Hi Experts,</P><P>&nbsp;</P><P>I have created a search query to fetch details from Linux log and extracted a timestamp field and converted that with command strftime.</P><P>Timestamp from Linux log:&nbsp;1628674387976621</P><P>| eval CT_time=strftime(Start_Time/pow(10,6),"%d/%m/%Y %H:%M:%S")&nbsp;</P><P>Now I would like to filter the events based on converted time, like From CT_time to CT_time.</P><P>&nbsp;</P><P>Please help with a query to filter with converted timestamp.</P><P>&nbsp;</P><P>Regards, Karthikeyan.SV</P> Fri, 13 Aug 2021 11:32:28 GMT Karthikeyan 2021-08-13T11:32:28Z https://community.splunk.com/t5/Getting-Data-In/Time-conversion-amp-filter/m-p/563168#M100339 <P>Hi Experts,</P><P>&nbsp;</P><P>I have created a search query to fetch details from Linux log and extracted a timestamp field and converted that with command strftime.</P><P>Timestamp from Linux log:&nbsp;1628674387976621</P><P>| eval CT_time=strftime(Start_Time/pow(10,6),"%d/%m/%Y %H:%M:%S")&nbsp;</P><P>Now I would like to filter the events based on converted time, like From CT_time to CT_time.</P><P>&nbsp;</P><P>Please help with a query to filter with converted timestamp.</P><P>&nbsp;</P><P>Regards, Karthikeyan.SV</P> Fri, 13 Aug 2021 11:32:28 GMT https://community.splunk.com/t5/Getting-Data-In/Time-conversion-amp-filter/m-p/563168#M100339 Karthikeyan 2021-08-13T11:32:28Z https://community.splunk.com/t5/Getting-Data-In/Time-conversion-amp-filter/m-p/563181#M100343 <P>Filtering events based on timestamps requires comparing timestamps, which is something Splunk cannot do with human-readable time strings.&nbsp; Splunk compares times in integer form.</P> Fri, 13 Aug 2021 13:18:54 GMT https://community.splunk.com/t5/Getting-Data-In/Time-conversion-amp-filter/m-p/563181#M100343 richgalloway 2021-08-13T13:18:54Z