topic Re: Adding seconds to _time in Splunk Search

Adding seconds to _time

ChhayaV — Wed, 25 Sep 2013 08:49:59 GMT

hi,

I want to add some seconds in the current _time.
Is there any build in function for it?

e.g_time=23:03:39.022
after adding 4.90 seocnds it should be 23:03:43.936

Thanks

Re: Adding seconds to _time

Ayn — Wed, 25 Sep 2013 08:54:08 GMT

_time is actually in epoch format, Splunk just converts the format automatically before showing it to you so that it's human readable. So, to add 4 seconds, just do eval _time=_time+4.

Note that this is purely a search-time operation - if you want to do this at index-time the problem is much more complex because functions for performing arithmetic etc are not available.

Re: Adding seconds to _time

ChhayaV — Wed, 25 Sep 2013 08:55:38 GMT

if it is 200 seconds then resulted output time should also have minutes modified

Re: Adding seconds to _time

Ayn — Wed, 25 Sep 2013 08:57:57 GMT

Yup. Epoch is just seconds, so add how many seconds you want.

Re: Adding seconds to _time

ChhayaV — Mon, 28 Sep 2020 14:50:23 GMT

got it ..but i am not able to see milliseconds

index=tm_idx host="server" index=tm_idx host="server" "finished executing normally" | rex field=_raw "(?i)Process\s(\"|\"})(?\w+)" | rex field=_raw "elapsed\stime\s(?\w+.\w+)\sseconds" | eval time=_time-myduration| convert timeformat="%m/%d/%Y %H:%M:%S" ctime(time) as timestr |table _time timestr _raw myduration

this is my search

Re: Adding seconds to _time

Ayn — Wed, 25 Sep 2013 11:52:46 GMT

Explain more clearly. What do you mean by not being able to see milliseconds? What are you expecting to see, and what are you not seeing?

Re: Adding seconds to _time

sowings — Wed, 25 Sep 2013 13:08:24 GMT

Your time format output truncates to seconds. You'll need to add some placeholder in the format string for milli / microseconds.

Re: Adding seconds to _time

ChhayaV — Thu, 26 Sep 2013 04:30:43 GMT

hi
input time: 23:03:43.936
after subtracting 4.09
expected output time: 23:03:39.022

but output time is 23:03:39

i gave %ms after %S but not working and when i export it to CSV time column is not proper it show ### in the column

Re: Adding seconds to _time

kristian_kolb — Thu, 26 Sep 2013 05:32:56 GMT

shouldn't the expected outcome be 23:03:39.846 ?

and for strftime/strptime, %3N, %6N are the variables for milli- and microseconds, respectively.

http://docs.splunk.com/Documentation/Splunk/5.0.5/SearchReference/Commontimeformatvariables

Re: Adding seconds to _time

ChhayaV — Thu, 26 Sep 2013 08:34:46 GMT

already tried

Re: Adding seconds to _time

sowings — Thu, 26 Sep 2013 13:03:02 GMT

This works, and gives milliseconds:

convert timeformat="%Y/%m/%d %H:%M:%S.%3N" ctime(_time) AS timestr

What did you try that didn't work?