Dashboards & Visualizations

How do I convert this timestamp string to a number?

luky
New Member

Hello all!

I have alphanumeric timestamps that I'd like to convert to seconds. I'm trying to convert these two timestamps to seconds and then subtract one from the other to find the total duration of a phone call. 

 

Wed Mar 03 13:38:36 PST 2021

Wed Mar 03 13:29:29 PST 2021

Could someone please point me in the right direction? Much appreciated, this has got me at my wit's end!

Labels (1)
0 Karma

acfecondo75
Path Finder

Hi luky!

You would accomplish this using an eval and the strptime function. The SPL below should work as long as you substitute the string_time variable that I used with whatever variable holds the time value in your data.

Once they're both converted, you can do another eval that subtracts one from the other.

| makeresults
| eval call_start="Wed Mar 03 13:29:29 PST 2021", call_end="Wed Mar 03 13:38:36 PST 2021"
| eval call_start_epoch=strptime(call_start,"%a %b %d %H:%M:%S %Z %Y"),call_end_epoch=strptime(call_end,"%a %b %d %H:%M:%S %Z %Y")
| eval call_duration=call_end_epoch - call_start_epoch

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's what the strptime() function is for.

| eval number = strptime(string, "%a %b %d %H:%M:%S %Z %Y")

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Jabernathy
New Member

That doesn't always work. I cant seem to find a good solution for this type of problem either.
I can't convert this timestamp for subtraction purposes for example (see how t3 column is empty?):
Screenshot 2024-09-08 at 12.13.26 AM.png

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Line 3 creates a string in t2 so line 4 should be parsing the string strptime not strftime

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...