Getting Data In

Concat time field to include start to end of hour

benj851
Explorer

Hello; 

I've tried a few ways, but have been unsuccessful in creating a _time field to include the datetime, and the end hour. Ex. 06/18/2021 08:00 - 08:59. I'd appreciate any assistance in getting there. 

When concating, the time field converts to unix. Then I can't convert it back to CTIME. 

Here's an example of the data pulled: 

index=foo host=hostfoo sourcetype=sourcefoo
| bin span=1h _time
| table _time

_time

2021-06-18 08:00

 

Desired: 

_time

2021-06-18 08:00 - 08:59
Labels (1)
0 Karma
1 Solution

aasabatini
Motivator

Hi @benj851 

try like this

 

<your search>
| eval date=strftime(_time, "%Y/%m/%d %H:%M")
| eval hour=strftime(_time, "%H")
| eval timestamp=date." "."-"." ".hour.":"."59"

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”

View solution in original post

0 Karma

aasabatini
Motivator

Hi @benj851 

try like this

 

<your search>
| eval date=strftime(_time, "%Y/%m/%d %H:%M")
| eval hour=strftime(_time, "%H")
| eval timestamp=date." "."-"." ".hour.":"."59"

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma

benj851
Explorer

Perfect thank you.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...