Dashboards & Visualizations

Add/Subtract from timestamp entered in a form.

itghelp
Path Finder

I have a form that takes 2 timestamps in UTC. I need to convert them to local time and then add or subtract an hour. So far I've tried:

host="juniper" port="$port$" src_translated_ip="$ip$"
timeformat="%Y-%m-%dT%H:%M:%S.%3N%"
earliest="$first$"
latest="$last$"

This correctly converts the UTC to local time, but I can't figure out how to add or subtract an hour to "$first$" and "$last$" before passing them to earliest and also making sure they get converted.

This was my attempt, but the timestamps are way off:

host="juniper" port="$port$" src_translated_ip="$ip$" timeformat="%Y-%m-%dT%H:%M:%S.%3N%Z" |
eval earliest=relative_time("$first$", "-1h") |
eval latest=relative_time("$last$", "+1h")

Tags (1)
0 Karma
1 Solution

itghelp
Path Finder

Turns out it wasn't so complicated:

ost="juniper" port="$port$" src_translated_ip="$ip$" timeformat="%Y-%m-%dT%H:%M:%S.%3N%Z" earliest="$first$-2h" latest="$last$+2h"

View solution in original post

0 Karma

itghelp
Path Finder

Turns out it wasn't so complicated:

ost="juniper" port="$port$" src_translated_ip="$ip$" timeformat="%Y-%m-%dT%H:%M:%S.%3N%Z" earliest="$first$-2h" latest="$last$+2h"

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...