topic Re: How to add time to an event in Reporting

How to add time to an event

Mary666 — Sat, 06 Mar 2021 00:25:55 GMT

Hello Splunk Community,

I have read through the Q&A 7 pages in and read through several instructions on how to do this, but still cant seem to find what I need to do. I am trying to add 1 hr and 15 min to the event latestEvent. Can obtain some guidance on how to add 1 hr and 15 min to a field? In this case the filed is latestEvent.

(index="xyz" event=submission ) OR (index="abc ) | eval latestEvent=case(event="submission", timeofsub) | eval Scheduled_Ingestion_Time=relative_time(latestEvent, "+3615") | stats latest(latestEvent) as latestEvent values(Scheduled_Ingestion_Time) as Scheduled_Ingestion_Time

Re: How to add time to an event

tscroggins — Sat, 06 Mar 2021 00:55:56 GMT

@Mary666

Timestamp fields like _time are integer Unix epoch values: the number of seconds elapsed since January 1, 1970 12:00 AM.

To add 1 hr and 15 min to a time field, add 4500 seconds:

| eval Scheduled_Ingestion_Time=latestEvent + 4500

If latestEvent isn't a time field, you'll need to convert it to one using whatever method is appropriate for your data. For example, if latestEvent is the string "2021-03-05 00:00:00" you would use:

| eval Scheduled_Ingestion_Time=strptime(latestEvent, "%F %T") + 4500

Re: How to add time to an event

Mary666 — Sat, 06 Mar 2021 02:59:03 GMT

Hi tscroggins,

Thanks for your quick reply. I tried your recommendation and it helped using | eval Scheduled_Ingestion_Time=strptime(latestEvent, "%F %T") + 4500 , but I have a question:

1. I only seem to get results in epoch time example:

The time I get is: 1613751347.000000
But I would like to convert it to Unix: 2021-02-19 07:00:47.089586

I have tried using | eval Scheduled_Ingestion_Time=strptime(latestArchive,"%Y-%m-%d %H:%M:%S.%3N") + 4500

Still get epoch time though. Any guidance on how to tackle this will greatly help.

Re: How to add time to an event

tscroggins — Sat, 06 Mar 2021 03:08:23 GMT

@Mary666

You have a few options, but the two simplest ones are:

To convert the field back to a string:

| eval Scheduled_Ingestion_Time=strftime(strptime(latestArchive, "%Y-%m-%d %H:%M:%S.%3N") + 4500, "%Y-%m-%d %H:%M:%S.%3N")

To leave the field an integer but display it as a string:

| eval Scheduled_Ingestion_Time=strptime(latestArchive, "%Y-%m-%d %H:%M:%S.%3N") + 4500

| fieldformat Scheduled_Ingestion_Time=strftime(Scheduled_Ingestion_Time, "%Y-%m-%d %H:%M:%S.%3N")

The time function names can be read as "string from time" and "string parse time."

Re: How to add time to an event

Mary666 — Sat, 06 Mar 2021 03:44:28 GMT

Thanks,

| eval Scheduled_Ingestion_Time=strftime(strptime(latestArchive, "%Y-%m-%d %H:%M:%S.%3N") + 4500, "%Y-%m-%d %H:%M:%S.%3N")

Did the trick 🙂