topic Re: How to search with time specified in milliseconds in Getting Data In

How to search with time specified in milliseconds

Daniel24 — Tue, 19 Mar 2024 23:54:10 GMT

I have two timestamps in milliseconds: start=1710525600000, end=1710532800000.

How can I search for logs between those timestamps? Let's say I want to run this query:

index=my_app | search env=production | search service=my-service

How to specify the time range in millis for this query?

Re: How to search with time specified in milliseconds

bowesmana — Tue, 19 Mar 2024 23:10:17 GMT

Your examples are round seconds, but if you have epoch times to search between use the epoch with decimal places where required, so your example (which actually has no millisecond time) could be

index=my_app earliest=1710525600.000 latest=1710532800.000 env=production service=my-service

Re: How to search with time specified in milliseconds

Daniel24 — Wed, 20 Mar 2024 08:20:40 GMT

@bowesmana I'm autogenerating those milliseconds and I can't manipulate them. That's why I'm asking. I know that `earliest` and `latest` should be in seconds, but I have milliseconds as input.

Re: How to search with time specified in milliseconds

ITWhisperer — Wed, 20 Mar 2024 09:14:52 GMT

It depends on how you are "auto-generating" them - you could possibly change the process that generates them to divide by 1000?

Re: How to search with time specified in milliseconds

Daniel24 — Wed, 20 Mar 2024 09:18:37 GMT

No, it's impossible to change the process, I don't control it. Is there any function in Splunk that can do this conversion? When I try earliest=timestamp/1000 it doesn't work.

Re: How to search with time specified in milliseconds

ITWhisperer — Wed, 20 Mar 2024 09:22:38 GMT

So, it depends on how you are getting these values and including them in your search. Please provide more details. (You may be able to use Splunk to preprocess your values in a subsearch, but it depends where they come from.)

Re: How to search with time specified in milliseconds

Daniel24 — Wed, 20 Mar 2024 09:26:43 GMT

I can paste those values as URL parameters. So, I can have this URL as input:
https://my.splunkcloud.com/en-GB/app/my_app/search?q=search%20index%3Dkubernetes_app%20env%3Dproduction%20service%3Dmy-service&display.page.search.mode=smart&dispatch.sample_ratio=1&earliest=1710525600000&latest=1710532800000

Re: How to search with time specified in milliseconds

bowesmana — Wed, 20 Mar 2024 09:30:39 GMT

Can you change the URL in any way or is that all you have to make a search and there's no other component or processed in the middle

Re: How to search with time specified in milliseconds

Daniel24 — Wed, 20 Mar 2024 09:33:57 GMT

I can't change the values that I paste into the URL. I can change the parameters in the query, but not the values. I have that number of milliseconds and can't manipulate it.

Re: How to search with time specified in milliseconds

bowesmana — Wed, 20 Mar 2024 09:38:47 GMT

If you can change the URL parameters then you can create a subsearch that takes the ms parameters as parameters e and l. In the subsearch you can do the division and rename the fields earliest and latest. When passed out of the subsearch they will be treated as earliest and latest

Re: How to search with time specified in milliseconds

bowesmana — Wed, 20 Mar 2024 09:45:47 GMT

This format of the query params

q=search%20index%3D_audit%20%5B%20%7C%20makeresults%20%7C%20eval%20e%3D1710924016000%2Cl%3D1710927616000%2C%20earliest%3De%2F1000%2C%20latest%3Dl%2F1000%20%7C%20fields%20earliest%20latest%20%5D

is what is required to search the _audit index for 1 hour, so if you can construct the subsearch and set the e and l parameters as in

%5B%20%7C%20makeresults%20%7C%20eval%20e%3D1710924016000%2Cl%3D1710927616000%2C%20earliest%3De%2F1000%2C%20latest%3Dl%2F1000%20%7C%20fields%20earliest%20latest%20%5D

it will do this search

index=_audit [ | makeresults | eval e=1710924016000,l=1710927616000, earliest=e/1000, latest=l/1000 | fields earliest latest ]

Re: How to search with time specified in milliseconds

Daniel24 — Wed, 20 Mar 2024 09:51:57 GMT

What does the whole query should look like?