topic Re: Convert splunk time format to epoc time. in Splunk Search

Convert splunk time format to epoc time.

AKG1_old1 — Tue, 29 Sep 2020 13:37:14 GMT

Hi,

Can we convert splunk specific time to epoc time ?

For example:
-4h@h

I am using a search query in which one token have value like this causing failure of that query.

Query :

working fine : eventtype=mlc | eval _time = 3423423423 + relative_time
Not working : eventtype=mlc | eval _time = -4h@h + relative_time

Thanks

Re: Convert splunk time format to epoc time.

somesoni2 — Fri, 07 Apr 2017 15:29:25 GMT

Try like this

eventtype=mlc | eval _time = if(len(replace("$yourtoken$","\d",""))=0,$yourtoken$,relative_time(now(),"$yourtoken$")) + relative_time

Basically checking if the token value is all numbers (not relative time modifier) then use the token value OR use the relative time modifier value instead.

Re: Convert splunk time format to epoc time.

woodcock — Sat, 08 Apr 2017 03:37:01 GMT

You use the relative_time() function and the now() function.

Re: Convert splunk time format to epoc time.

AKG1_old1 — Tue, 29 Sep 2020 13:38:42 GMT

Thank you @somesoni2. it helped me to fix the problem.
the below one worked fine.
eventtype=mlc | eval start_time = if(len(replace("$time_token.earliest$","\d",""))=0,"$time_token.earliest$",0) | eval _time = start_time + relative_time