https://community.splunk.com/t5/Splunk-Search/Is-there-a-conversion-function-for-time-modifiers/m-p/223464#M65793 <P>That's the one, thanks!</P> Fri, 26 Feb 2016 15:27:04 GMT johnraftery 2016-02-26T15:27:04Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-conversion-function-for-time-modifiers/m-p/223460#M65789 <P>Hi, I'm using a time picker which gives you a start and end token as time modifiers (eg "-2d@d - now" for the last two days). See <A href="http://docs.splunk.com/Documentation/Splunk/6.3.3/Search/Specifytimemodifiersinyoursearch">http://docs.splunk.com/Documentation/Splunk/6.3.3/Search/Specifytimemodifiersinyoursearch</A></P> <P>Is there a function to convert the time modifier into an absolute time (ie 1456312200 - 1456482900)? I know I can put the time modifiers into the earliest and latest tags of my query, but I'm actually querying a lookup table so there is no _time field to base it on; I need to restrict the time in the query itself.</P> <P>Thanks,<BR /> John</P> Fri, 26 Feb 2016 13:58:41 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-conversion-function-for-time-modifiers/m-p/223460#M65789 johnraftery 2016-02-26T13:58:41Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-conversion-function-for-time-modifiers/m-p/223461#M65790 <P>Hi,</P> <P>Sorry I'm not too sure what you are referring to.<BR /> Please take a look at the relative_time() function and let me know if that's what you are looking:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Commonevalfunctions#Date_and_Time_functions">http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Commonevalfunctions#Date_and_Time_functions</A></P> Fri, 26 Feb 2016 14:29:25 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-conversion-function-for-time-modifiers/m-p/223461#M65790 javiergn 2016-02-26T14:29:25Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-conversion-function-for-time-modifiers/m-p/223462#M65791 <P>Try the <CODE>relative_time()</CODE> function. For example,</P> <PRE><CODE>... | eval absTime = relative_time(now(), $start$) | ... </CODE></PRE> Fri, 26 Feb 2016 14:33:06 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-conversion-function-for-time-modifiers/m-p/223462#M65791 richgalloway 2016-02-26T14:33:06Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-conversion-function-for-time-modifiers/m-p/223463#M65792 <P>That's the one, thanks!</P> Fri, 26 Feb 2016 15:27:00 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-conversion-function-for-time-modifiers/m-p/223463#M65792 johnraftery 2016-02-26T15:27:00Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-conversion-function-for-time-modifiers/m-p/223464#M65793 <P>That's the one, thanks!</P> Fri, 26 Feb 2016 15:27:04 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-conversion-function-for-time-modifiers/m-p/223464#M65793 johnraftery 2016-02-26T15:27:04Z