topic Issue with Time Conversion in JSON String in Splunk Search

Issue with Time Conversion in JSON String

leftrightleft — Wed, 17 Nov 2021 04:35:04 GMT

Hey 👋,

I'm trying to get the time difference between when an event was received and a string representation of the time in the event.

Here's an example of the event:

{ "action": "created", "alert": { "number": 818, "created_at": "2021-11-16T21:52:12Z", "url": "https://somewebsite.com" } }

The issue is the conversion of the time in "alert.created_at" from string to epoch. Once I'm able to get the epoch representation, calculating the difference from _time is easy.

I'm working off this eval statement, but cant get it to work:

| eval strtime=strptime(alert.created_at, "%Y-%m-%dT%H:%M:%SZ") | table strtime

Any thoughts? Thanks!

Re: Issue with Time Conversion in JSON String

kamlesh_vaghela — Wed, 17 Nov 2021 05:30:21 GMT

@leftrightleft

Can you please try this?

| eval strtime=strptime('alert.created_at', "%Y-%m-%dT%H:%M:%SZ")

My Sample Search :

| makeresults | eval _raw="{\"action\": \"created\",\"alert\": {\"number\": 818,\"created_at\": \"2021-11-16T21:52:12Z\",\"url\": \"https://somewebsite.com\"}}" | spath | eval strtime=strptime('alert.created_at', "%Y-%m-%dT%H:%M:%SZ")

Re: Issue with Time Conversion in JSON String

leftrightleft — Wed, 17 Nov 2021 15:38:58 GMT

@kamlesh_vaghela, I wish I could give you more than just a thumbs up. At a minimum, you deserve a high five. Honestly, I would probably even give you a hug if I could 😄

Seriously though, thanks a lot. I really was struggling with this. I didn't realize the single quotes were what was needed. I actually tried double quotes around the field name at one point, but it interpreted it as literally "alert.created_at".