topic Re: Time stamp in Splunk Search

Time stamp

smanojkumar — Thu, 08 Sep 2022 09:40:26 GMT

Start_Time=092659
Start_Date=20220908

My requirement is to find the job amount many jobs that runs longer than a day, the above 2 fields relates the job start date and time,

Re: Time stamp

ITWhisperer — Thu, 08 Sep 2022 09:54:43 GMT

You will need more information than that - when does the job end? how are the events with the job start related to the events for the job end?

Re: Time stamp

smanojkumar — Thu, 08 Sep 2022 10:21:17 GMT

these jobs are currently running, so we won't have job end details.

I tried to compare with current time stamp (after converting current time to seconds) and if its greater than 86400 seconds, then the alert should trigger, but I'm having the field in separate for date and time (Start_Date , Start_Time), I'm not sure to club it and convert to seconds.

Re: Time stamp

ITWhisperer — Thu, 08 Sep 2022 10:30:09 GMT

If these fields are already strings, you can do something like this

| eval Start_Timestamp=strptime(Start_Date.Start_Time,"%Y%m%d%H%M%S")