topic Re: How can I convert my time format to epoch time? in Splunk Search

How can I convert my time format to epoch time?

m7787580 — Sat, 25 Feb 2017 07:31:34 GMT

Format i have in Splunk:- Duration as 9h:42m:32s

I tried to use below search but it didn't worked.

eval "Duration"=strptime("Duration", "%Hh:%Mm:%Ss")|

Thanks in Advance

Re: How can I convert my time format to epoch time?

rjthibod — Sat, 25 Feb 2017 12:35:29 GMT

That value is not compatible with converting to epoch time because Splunk doesn't know when the time starts. The strptime function expects you are sending it some form of wall clock time, not a duration.

So, what is the start time, and what output would you really like to see: a clock time, or the number of seconds that duration represents (e.g., 34,952 seconds)?

Re: How can I convert my time format to epoch time?

Richfez — Sat, 25 Feb 2017 13:08:06 GMT

You are nearly right - I think your only problem is that you are quoting your field inside the strptime - when you quote it Splunk treats is as a string with a value of "Duration" and tries to extract Hours, Minutes and Seconds from the word "Duration", not the field.

Try

eval "Duration"=strptime(Duration, "%Hh:%Mm:%Ss")

If your "Duration" field ever has spaces, you can use single quotes to quote it and it'll work. See all three (No quotes, single quotes and regular quotes) in the below "run anywhere" example.

| makeresults 
| eval dur1="9h:42m:32s" 
| eval "edur1"=strptime("dur1", "%Hh:%Mm:%Ss")
| eval "edur2"=strptime('dur1', "%Hh:%Mm:%Ss")
| eval "edur3"=strptime(dur1, "%Hh:%Mm:%Ss")

Notice it doesn't return "edur1".

 _time                      dur1           edur2                 edur3  
    2017-02-25 07:01:47     9h:42m:32s  1488037352.000000   1488037352.000000

Re: How can I convert my time format to epoch time?

somesoni2 — Sat, 25 Feb 2017 20:16:35 GMT

Do you want to convert your duration to epoch time or convert it to number of seconds? If it's later, try like this

your current search |  eval Duration=replace(Duration,"[hms]","")  | convert dur2sec(Duration) as Duration

your current search |  eval Duration=strptime(Duration,"%Hh:%Mm:%Ss")-relative_time(now(),"@d")