Getting Data In

Concat time field to include start to end of hour

benj851
Explorer

Hello; 

I've tried a few ways, but have been unsuccessful in creating a _time field to include the datetime, and the end hour. Ex. 06/18/2021 08:00 - 08:59. I'd appreciate any assistance in getting there. 

When concating, the time field converts to unix. Then I can't convert it back to CTIME. 

Here's an example of the data pulled: 

index=foo host=hostfoo sourcetype=sourcefoo
| bin span=1h _time
| table _time

_time

2021-06-18 08:00

 

Desired: 

_time

2021-06-18 08:00 - 08:59
Labels (2)
0 Karma
1 Solution

aasabatini
Motivator

Hi @benj851 

try like this

 

<your search>
| eval date=strftime(_time, "%Y/%m/%d %H:%M")
| eval hour=strftime(_time, "%H")
| eval timestamp=date." "."-"." ".hour.":"."59"

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”

View solution in original post

0 Karma

aasabatini
Motivator

Hi @benj851 

try like this

 

<your search>
| eval date=strftime(_time, "%Y/%m/%d %H:%M")
| eval hour=strftime(_time, "%H")
| eval timestamp=date." "."-"." ".hour.":"."59"

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma

benj851
Explorer

Perfect thank you.

0 Karma
Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...