topic Re: Convert earliest_time latest_time notation to epoch in Splunk Search

Convert earliest_time latest_time notation to epoch

D2SI — Wed, 21 Oct 2020 08:45:09 GMT

Hello there!

Is there a known method (a function, a command, built-in or custom, a search trick) to convert the earliest_time and latest_time notation to epoch for instance?

For instance, I need to convert this:

earliest_time
-15m@m

latest_time
-5m@m

into an epoch timestamp so I can calculate the interval between them.

As the notation is flexible, I want to check if there is something available already rather than try to build a dirty search that would try to cover every variation of the notation.

Thanks in advance for any hint!

Re: Convert earliest_time latest_time notation to epoch

richgalloway — Wed, 21 Oct 2020 13:07:39 GMT

Use the relative_time function as in this run-anywhere example.

| makeresults | eval now=now(), interval="-15m@m", ago=relative_time(now, interval) | table now, interval, ago

Re: Convert earliest_time latest_time notation to epoch

D2SI — Wed, 21 Oct 2020 14:35:44 GMT

Thanks a lot!