topic Re: Can't convert timeformat to unix in Splunk Search

Can't convert timeformat to unix

dtaylor — Thu, 29 May 2025 03:41:36 GMT

Hopefully I've only got a small problem this time, but I've had no luck fixing it despite hours of trying. All I'm trying to do is convert a string time field to unix using strptime. This is my time field:

Ended: 0d1h55m0s

I've been trying to convert it to unix using the following command:

| eval time_sec = strptime('Time', "Ended: %dd%Hh%Mm%Ss")

For clarity, this is the full search:

| inputlookup metrics.csv | eval occurred=strftime(strptime(occurred,"%a, %d %b %Y %T %Z"), "%F %T %Z") | eval closed=strftime(strptime(closed,"%a, %d %b %Y %T %Z"), "%F %T %Z") | eval time_sec = strptime('Time', "Ended: %dd%Hh%Mm") | where strptime(occurred, "%F %T") >= strptime("2025-05-01 00:00:00", "%F %T") AND (isnull(closeReason) OR closeReason="Resolved") | fillnull value=Resolved closeReason

The example time I've posted above 0d1h55m0s should ideally convert to 6900(seconds).

Re: Can't convert timeformat to unix

PrewinThomas — Thu, 29 May 2025 03:49:21 GMT

@dtaylor

strptime expects a date/time string, not a duration.
Your field (Ended: 0d1h55m0s) is a duration (days, hours, minutes, seconds), not an absolute date/time.

try below,

| rex field=Time "Ended: (?<days>\d+)d(?<hours>\d+)h(?<minutes>\d+)m(?<seconds>\d+)s"
| eval duration = (days*86400) + (hours*3600) + (minutes*60) + seconds

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a kudos. Thanks!

Re: Can't convert timeformat to unix

yuanliu — Thu, 29 May 2025 06:02:24 GMT

In addition to @PrewinThomas's breakdown method, I can suggest relative_time to take advantage of Splunk's format strings.

| eval offset = replace('Time', "Ended: (\d+d)(\d+h)(\d+m)(\d+s)", "+\1+\2+\3") | eval time_sec = relative_time(0, offset)

relative_time's offset requires a + or a - before every time unit. So, we transform 0d1h55m0s to +0d+1h+55m.