topic Re: convert timerange to epoch values in Splunk Search

convert timerange to epoch values

0range — Tue, 15 Jul 2014 15:17:06 GMT

Hello!

I want to use my timerange as a filter in a search on a dashboard, like this:
..... | where mydate < $timepicker.latest$

But i need to conver values like "@d" , "-1h" and so on to epoch.
And the latest may be already in epoch format. Then I do not need to convert.
How can I do this?

Re: convert timerange to epoch values

martin_mueller — Tue, 15 Jul 2014 15:28:12 GMT

For this notation you can use the relative_time() function:

... | where mydate < relative_time(now(), "$timepicker.latest$")

However, you first need to check whether it's a number or not and only apply this if it isn't:

... | where mydate < if(isnum("$timepicker.latest$"), $timepicker.latest$, relative_time(now(), "$timepicker.latest$"))

Note, I'm not 100% certain if this catches every case imaginable or not - make sure you test everything your users will need later.

Re: convert timerange to epoch values

somesoni2 — Mon, 28 Sep 2020 17:04:22 GMT

If the same timepicker is used to define timerange for the search then, this should work.

your search ..| where mydate < [|gentimes start=-1 | addinfo | eval search=info_max_time | table search]

The 'addinfo' command will create fields info_min_time (based on search's earliest time) and info_max_time (based on search's latest time) which are in epoch already.

Re: convert timerange to epoch values

0range — Tue, 15 Jul 2014 15:40:10 GMT

No, the timepicker is not the same

Re: convert timerange to epoch values

0range — Tue, 15 Jul 2014 15:42:59 GMT

seems that @d is not compatible with relative_time function

Re: convert timerange to epoch values

martin_mueller — Tue, 15 Jul 2014 15:47:54 GMT

It is. Run this dummy query to confirm:

| stats count as now | eval now = strftime(now(), "%+") | eval at_d = strftime(relative_time(now(), "@d"), "%+")

Re: convert timerange to epoch values

jeffland — Mon, 18 Jul 2016 08:34:38 GMT

It appears you also have to catch a value of "now" explicitly, i.e.

... | where mydate < case(isnum("$timepicker.latest$"), $timepicker.latest$, $timepicker.latest$="now", now(), 1=1, relative_time(now(), "$timepicker.latest$"))