topic Re: How can I manage relative time values passed from a time input and convert to epoch time? in Splunk Search

How can I manage relative time values passed from a time input and convert to epoch time?

andrewtrobec — Wed, 28 Feb 2018 16:08:50 GMT

Hello,

I would like to convert all possible values set in a time input to epoch time format. This means that it should manage values like:

-d@d @w now

i have found similar threads like this which recommend the relative_time() function, but it doesn't manage all cases. I also found a thread about filtering all values in a time input within a search:

| where if("$time_input.earliest$"!="0" AND "$time_input.earliest$"!="",_time>=if(replace("$time_input.earliest$","\d","")!="",relative_time(now(),if("$time_input.earliest$"="now","-0m","$time_input.earliest$")),"$time_input.earliest$"),0=0) AND if("$time_input.latest$"!="0" AND "$time_input.latest$"!="",_time<if(replace("$time_input.latest$","\d","")!="",relative_time(now(),if("$time_input.latest$"="now","-0m","$time_input.latest$")),"$time_input.latest$"),0=0)

but I cannot figure out how to convert this for use in an eval

Could somebody help me out?

Thank you and best regards,

Andrew

Re: How can I manage relative time values passed from a time input and convert to epoch time?

elliotproebstel — Wed, 28 Feb 2018 17:55:06 GMT

Is the timepicker being used to set the parameters of the search? If so, you can do this:

| addinfo
| eval early_time=info_min_time, late_time=info_max_time

And if you don't like having the extra info* fields, you can follow that with:

| fields - info_max_time info_min_time info_search_time info_sid

Re: How can I manage relative time values passed from a time input and convert to epoch time?

andrewtrobec — Wed, 28 Feb 2018 19:34:50 GMT

@elliotproebstel this is perfect! No conversions required!

Re: How can I manage relative time values passed from a time input and convert to epoch time?

elliotproebstel — Wed, 28 Feb 2018 19:35:56 GMT

Great! I converted it to an answer so you can accept it to help others find it in the future. 🙂