topic Re: Apply timeformat to earliest/latest attributes in Getting Data In

Apply timeformat to earliest/latest attributes

frank_zhang — Thu, 18 Oct 2012 22:10:03 GMT

Hi,

We embed splunk in our product and need to generate searches with earliest/latest attributes based on timestamp user picks, and our server and splunk indexer might be running in different timezones. We can either generate a timestamp based on indexer's timezone and put no timezone in it, such as:

sourcetype=foo index=bar earliest=10/18/2012:13:00:00 |...

Or generate timestamp based on other timezone or UTC and put timezone info in it, such as:

sourcetype=foo index=bar timeformat%m/%d/%Y:%H:%M:%S:%z earliest=10/18/2012:17:00:00:+0000 |...

Is there any negative impact such as performance overhead with the second option due to adding "timeformat%m/%d/%Y:%H:%M:%S:%z" into the search?

Thanks in advance.

Re: Apply timeformat to earliest/latest attributes

kristian_kolb — Fri, 19 Oct 2012 05:12:11 GMT

I guess you've ruled out the possibility to use relative time modifiers, e.g. -24h, @d, etc etc?

Re: Apply timeformat to earliest/latest attributes

_d_ — Fri, 19 Oct 2012 05:15:01 GMT

Splunk will convert earliest and latest timestamps in epoch format internally. Therefore, since you can generate timestamps in UTC, your best bet would be to have earliest and latest in epoch as well.

Ex: index=bar sourcetype=foo earliest=1350538170 latest=1350538870 | more search commands

Hope this helps,

Re: Apply timeformat to earliest/latest attributes

frank_zhang — Fri, 19 Oct 2012 15:46:42 GMT

With our GUI we allow users to specify both absolute and relative time range, we generate values like -24h for the latter case.

Re: Apply timeformat to earliest/latest attributes

frank_zhang — Fri, 19 Oct 2012 15:48:52 GMT

That's the first option we considered, however it makes debugging a bit harder since you have to convert from epoch time in order to figure out that the time range specified here, doesn't it?