topic Re: How do I convert these timestamps to epoch? in Getting Data In

How do I convert these timestamps to epoch?

kmccowen — Wed, 06 Jul 2016 18:25:51 GMT

Need help converting these times to epoch so that I can do a DIFF between them.

branchExecutionStartTime=Wed Jul 06 09:21:22 CDT 2016
branchExecutionEndTime=Wed Jul 06 09:21:22 CDT 2016

Can anyone help?

Re: How do I convert these timestamps to epoch?

kbarker302 — Wed, 06 Jul 2016 18:41:03 GMT

See the answer posted here:

https://answers.splunk.com/answers/114818/find-the-difference-between-two-date-time-values.html

I tweaked the code sample from the above post to match the date format example you provided:

your_base_search |
| eval branchExecutionStartTime="Wed Jul 06 09:21:22 CDT 2016"
| eval branchExecutionEndTime="Wed Jul 06 09:21:22 CDT 2016"
| eval it = strptime(branchExecutionStartTime, "%a %b %e %H:%M:%S %Z %Y") 
| eval ot = strptime(branchExecutionEndTime, "%a %b %e %H:%M:%S %Z %Y") 
| eval diff = tostring((ot - it), "duration") 
| table in_time, out_time, diff

For reference, below are the various date/time format variables Splunk uses:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables

Re: How do I convert these timestamps to epoch?

somesoni2 — Wed, 06 Jul 2016 18:41:24 GMT

Have you looked at convert OR eva-strptime commands? Are the timestamp field already extracted?
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/convert
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions#Date_and_Time_functions