topic Re: How to subtract a static number (e.g.. minutes, hours, seconds) from a timestamp? in Splunk Search

How to subtract a static number (e.g.. minutes, hours, seconds) from a timestamp?

jclemons7 — Thu, 10 Dec 2015 17:57:19 GMT

Hello,

I have a timestamp formatted as 2015-10-14T10:04:47.962Z and I'd like to add or subtract a fixed number of minutes from it. I've tried things similar to timestamp-5m and stuff that I'm too embarrassed to put here, to no avail. Your help is GREATLY appreciated.

Re: How to subtract a static number (e.g.. minutes, hours, seconds) from a timestamp?

richgalloway — Thu, 10 Dec 2015 18:15:35 GMT

There are two ways to do that (perhaps others will have more), but both require the timestamp be converted to epoch time first.

... | eval ts=strptime(timestamp, "%Y-%m-%dT%H:%M:%S.%3N%Z") | eval newts=ts-300 | ...

... | eval ts=strptime(timestamp, "%Y-%m-%dT%H:%M:%S.%3N%Z") | eval newts=relative_time(ts, -5m) | ...

Re: How to subtract a static number (e.g.. minutes, hours, seconds) from a timestamp?

jclemons7 — Thu, 10 Dec 2015 18:58:10 GMT

Your answer worked, but it dawned on me that I already had the value in epoch.. so I just did this

| eval ts=(_time - (5 * 60))  | .....

Re: How to subtract a static number (e.g.. minutes, hours, seconds) from a timestamp?

gabrell — Mon, 14 Dec 2015 17:38:37 GMT

Hi, how can I convert this format of Time?

start time: 2015-12-13T23:55:02+00:00
end time : 2015-12-15T23:55:02+00:00

And then I need to get the time taken from start to end TMA = (Start time - End Time) | table TMA

Can you help me out?

Thanks.

Re: How to subtract a static number (e.g.. minutes, hours, seconds) from a timestamp?

richgalloway — Mon, 14 Dec 2015 17:58:15 GMT

Please post a new question.