All Apps and Add-ons

How to convert 2021-12-09 11:46:50.000069 timestamp to epoch time.

cadrija
Path Finder

I have the following data in the table.

cadrija_0-1639376295685.png

 

I need to get the duration of the batch running time, I have the start & end time of each date. I need to calculate Batch_End-Batch_Start. 
Normal eval is not giving me any output. Hence I was thinking of converting the timestamps in epoc & then doing eval Duration=(End_epoc-Start_epoc).

For this I need to convert timestamp like 2021-12-09 11:46:50.000069 to epoch time.

Please help.

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval end_epoch=strptime(Batch_end,"%Y-%m-%d %H:%M:%S.%6Q")

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @cadrija,

did you tried to use eval strptime at the end of the search?

something like this_

<all_your_search>
| eval duration=strptime(batch_end,"%Y-%m-%d %H:%M:%S.%6N")-strptime(batch_start,"%Y-%m-%d %H:%M:%S.%6N")

Ciao.

Giuseppe

cadrija
Path Finder

@gcusello This works!
Thanks a lot!

0 Karma

cadrija
Path Finder

@gcusello Okay let me try this.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval end_epoch=strptime(Batch_end,"%Y-%m-%d %H:%M:%S.%6Q")

cadrija
Path Finder

Thanks @ITWhisperer 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...