Getting Data In

How can I get my Splunk events to use Star Trek "Stardate" time?

carasso
Splunk Employee
Splunk Employee

How can I get my Splunk events to use Star Trek "Stardate" time?

ENGAGE

A stardate is a date in the fictional system of time measurement developed for Star Trek, commonly heard at the beginning of a voiceover log entry such as "Captain's log, stardate 41153.7. Our destination is planet Deneb IV..." Writers and producers have selected numbers using different methods over the years, some more random than others, which makes it impossible to convert all stardates into equivalent calendar dates.

      http://en.wikipedia.org/wiki/Stardate
Tags (4)
1 Solution

carasso
Splunk Employee
Splunk Employee

The following series of eval commands calculate the Stardate in the field "star_date".
First it determines the year, the length of the year, and the proportion of the year that has gone by. Years are relative to year 2323.

< your search >
| eval year=strftime(_time, "%Y")
| eval leap = if((year % 4 == 0) and ((year % 100 != 0) or (year % 400 == 0)), "1", "0")
| eval length = if(leap=="1", 31622400, 31526000)
| eval time = _time - (60*date_zone) 
| eval year_date = relative_time(time,"@y")
| eval star_time =((time - year_date) * 1000 / length )
| eval star_year = year - 2323
| eval star_date = star_year.star_time 

There's an interesting bit of detail regarding timezones in that the snap-to-times in Splunk are local to your local timezone, meaning @y (the beginning of the year) is different for users in California and Russia. To compensate for that, we modify the 'time' value with the date_zone field.

This example is good for introducing eval, strftime, if(), and relative_time().

View solution in original post

carasso
Splunk Employee
Splunk Employee

The following series of eval commands calculate the Stardate in the field "star_date".
First it determines the year, the length of the year, and the proportion of the year that has gone by. Years are relative to year 2323.

< your search >
| eval year=strftime(_time, "%Y")
| eval leap = if((year % 4 == 0) and ((year % 100 != 0) or (year % 400 == 0)), "1", "0")
| eval length = if(leap=="1", 31622400, 31526000)
| eval time = _time - (60*date_zone) 
| eval year_date = relative_time(time,"@y")
| eval star_time =((time - year_date) * 1000 / length )
| eval star_year = year - 2323
| eval star_date = star_year.star_time 

There's an interesting bit of detail regarding timezones in that the snap-to-times in Splunk are local to your local timezone, meaning @y (the beginning of the year) is different for users in California and Russia. To compensate for that, we modify the 'time' value with the date_zone field.

This example is good for introducing eval, strftime, if(), and relative_time().

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!