https://community.splunk.com/t5/Splunk-Search/Using-eval-to-create-date-in-epoch-time/m-p/356485#M105475 <P>this did the trick, thank you!!</P> Fri, 22 Dec 2017 16:50:51 GMT hcannon 2017-12-22T16:50:51Z https://community.splunk.com/t5/Splunk-Search/Using-eval-to-create-date-in-epoch-time/m-p/356482#M105472 <P>I need to create a field <CODE>today</CODE> that is equal to the epoch timestamp in milliseconds for midnight yesterday. I've been successful in using eval for this, but splunk is adding ".000" to the end of the field value and I can't for the life of me figure out why or how to remove .000, so that the value can be passed to a dbxquery formatted in milliseconds. </P> <P>I've tried using <CODE>rex mode=sed field=today "s/.000//"</CODE>, then attempted to convert the value to a string first, before sending to rex/sed.<BR /> The .000 persists.</P> <P><CODE>...| eval today=(relative_time(now(),"-1d@d")*1000) | top today</CODE></P> <P>search result:<BR /> <CODE>today=1513832400000.000</CODE></P> Fri, 22 Dec 2017 16:11:58 GMT https://community.splunk.com/t5/Splunk-Search/Using-eval-to-create-date-in-epoch-time/m-p/356482#M105472 hcannon 2017-12-22T16:11:58Z https://community.splunk.com/t5/Splunk-Search/Using-eval-to-create-date-in-epoch-time/m-p/356483#M105473 <P>Try this</P> <PRE><CODE>..| eval today=round(relative_time(now(),"-1d@d")*1000) | top today </CODE></PRE> Fri, 22 Dec 2017 16:46:58 GMT https://community.splunk.com/t5/Splunk-Search/Using-eval-to-create-date-in-epoch-time/m-p/356483#M105473 somesoni2 2017-12-22T16:46:58Z https://community.splunk.com/t5/Splunk-Search/Using-eval-to-create-date-in-epoch-time/m-p/356484#M105474 <P>Try</P> <PRE><CODE>eval today=round(relative_time(now(), “-1d@d”) * 1000, 0) </CODE></PRE> Fri, 22 Dec 2017 16:47:15 GMT https://community.splunk.com/t5/Splunk-Search/Using-eval-to-create-date-in-epoch-time/m-p/356484#M105474 micahkemp 2017-12-22T16:47:15Z https://community.splunk.com/t5/Splunk-Search/Using-eval-to-create-date-in-epoch-time/m-p/356485#M105475 <P>this did the trick, thank you!!</P> Fri, 22 Dec 2017 16:50:51 GMT https://community.splunk.com/t5/Splunk-Search/Using-eval-to-create-date-in-epoch-time/m-p/356485#M105475 hcannon 2017-12-22T16:50:51Z