Dashboards & Visualizations

Add/Subtract from timestamp entered in a form.

itghelp
Path Finder

I have a form that takes 2 timestamps in UTC. I need to convert them to local time and then add or subtract an hour. So far I've tried:

host="juniper" port="$port$" src_translated_ip="$ip$"
timeformat="%Y-%m-%dT%H:%M:%S.%3N%"
earliest="$first$"
latest="$last$"

This correctly converts the UTC to local time, but I can't figure out how to add or subtract an hour to "$first$" and "$last$" before passing them to earliest and also making sure they get converted.

This was my attempt, but the timestamps are way off:

host="juniper" port="$port$" src_translated_ip="$ip$" timeformat="%Y-%m-%dT%H:%M:%S.%3N%Z" |
eval earliest=relative_time("$first$", "-1h") |
eval latest=relative_time("$last$", "+1h")

Tags (1)
0 Karma
1 Solution

itghelp
Path Finder

Turns out it wasn't so complicated:

ost="juniper" port="$port$" src_translated_ip="$ip$" timeformat="%Y-%m-%dT%H:%M:%S.%3N%Z" earliest="$first$-2h" latest="$last$+2h"

View solution in original post

0 Karma

itghelp
Path Finder

Turns out it wasn't so complicated:

ost="juniper" port="$port$" src_translated_ip="$ip$" timeformat="%Y-%m-%dT%H:%M:%S.%3N%Z" earliest="$first$-2h" latest="$last$+2h"

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...