https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-fields-to-epoch-time-after-a-join-to/m-p/149688#M30472 <P>Thanks so lot! This is perfect!</P> Thu, 16 Apr 2015 19:27:45 GMT singhbc 2015-04-16T19:27:45Z https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-fields-to-epoch-time-after-a-join-to/m-p/149682#M30466 <P>I have a search that uses "join" which uses two sourcetypes to search the events and then joins them using a common field called ID. It works good to show me that for an ID, a service was called in sourcetype=A with timestamp in date_year (month, hour, minute and second) and ERROR was flagged in sourcetype=B with timestamp _time.</P> <P>What i need to do now is to subtract the <CODE>_time</CODE> from the <CODE>date_hour</CODE>, <CODE>date_minute</CODE> and <CODE>date_second</CODE> to get the difference. What is the best way to do that? Should I convert the <CODE>date_year</CODE>, <CODE>date_month</CODE> and so on to epoch time first? If yes how?</P> Thu, 16 Apr 2015 17:45:57 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-fields-to-epoch-time-after-a-join-to/m-p/149682#M30466 singhbc 2015-04-16T17:45:57Z https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-fields-to-epoch-time-after-a-join-to/m-p/149683#M30467 <P>Not sure about the requirement here. If you have <CODE>date_*</CODE> fields in your sourcetype="A" then you should have a field _time as well, in epoch format. Whether subtraction of two _time (you would have rename the field to something else in order to have both time value from both the sourcetypes) values would not suffice?</P> Thu, 16 Apr 2015 18:00:52 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-fields-to-epoch-time-after-a-join-to/m-p/149683#M30467 somesoni2 2015-04-16T18:00:52Z https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-fields-to-epoch-time-after-a-join-to/m-p/149684#M30468 <P>the <CODE>date_*</CODE> fields are for the timestamp for when a "service" was called for an ID, and the <EM>time is for when the ERROR occurred for the same ID and they are about 10+ seconds apart, after the "join" is done, and after the "join" is done, if i look at the events, it only shows the timestamp for the ERROR along with the event, whereas the `date</EM><EM><CODE>shows only in the field list on the left side. and I have confirmed that the</CODE>date_</EM>` corresponds to the timestamp for the service in sourcetype="A" in a separate standalone search for that service. hope I am able to clarify.</P> Thu, 16 Apr 2015 18:12:48 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-fields-to-epoch-time-after-a-join-to/m-p/149684#M30468 singhbc 2015-04-16T18:12:48Z https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-fields-to-epoch-time-after-a-join-to/m-p/149685#M30469 <P>You can use strptime function with <CODE>eval/where</CODE> to get the corresponding epoch time value from <CODE>date_*</CODE> fields.</P> <P>try something like this</P> <PRE><CODE>your current search so far | eval timeA=strptime(date_year."-".date_month."-".date_mday." ".date_hour.":".date_minute.":".date_second,"%Y-%b-%d %H:%M:%S") | eval duration=_time-timeA </CODE></PRE> Thu, 16 Apr 2015 18:39:28 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-fields-to-epoch-time-after-a-join-to/m-p/149685#M30469 somesoni2 2015-04-16T18:39:28Z https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-fields-to-epoch-time-after-a-join-to/m-p/149686#M30470 <P>date_month is a string, how to convert it to integer value?</P> Thu, 16 Apr 2015 19:14:47 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-fields-to-epoch-time-after-a-join-to/m-p/149686#M30470 singhbc 2015-04-16T19:14:47Z https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-fields-to-epoch-time-after-a-join-to/m-p/149687#M30471 <P>just updated my search to handle string date_month (replace %m with %b)</P> Thu, 16 Apr 2015 19:16:51 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-fields-to-epoch-time-after-a-join-to/m-p/149687#M30471 somesoni2 2015-04-16T19:16:51Z https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-fields-to-epoch-time-after-a-join-to/m-p/149688#M30472 <P>Thanks so lot! This is perfect!</P> Thu, 16 Apr 2015 19:27:45 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-fields-to-epoch-time-after-a-join-to/m-p/149688#M30472 singhbc 2015-04-16T19:27:45Z