How can I get my Splunk events to use Star Trek "Stardate" time?

[carasso]

How can I get my Splunk events to use Star Trek "Stardate" time?

A stardate is a date in the fictional system of time measurement developed for Star Trek, commonly heard at the beginning of a voiceover log entry such as "Captain's log, stardate 41153.7. Our destination is planet Deneb IV..." Writers and producers have selected numbers using different methods over the years, some more random than others, which makes it impossible to convert all stardates into equivalent calendar dates.

      http://en.wikipedia.org/wiki/Stardate

[carasso · Accepted solution]

The following series of eval commands calculate the Stardate in the field "star_date".
First it determines the year, the length of the year, and the proportion of the year that has gone by. Years are relative to year 2323.

< your search >
| eval year=strftime(_time, "%Y")
| eval leap = if((year % 4 == 0) and ((year % 100 != 0) or (year % 400 == 0)), "1", "0")
| eval length = if(leap=="1", 31622400, 31526000)
| eval time = _time - (60*date_zone) 
| eval year_date = relative_time(time,"@y")
| eval star_time =((time - year_date) * 1000 / length )
| eval star_year = year - 2323
| eval star_date = star_year.star_time 

There's an interesting bit of detail regarding timezones in that the snap-to-times in Splunk are local to your local timezone, meaning @y (the beginning of the year) is different for users in California and Russia. To compensate for that, we modify the 'time' value with the date_zone field.

This example is good for introducing eval, strftime, if(), and relative_time().