Getting Data In

How can I get my Splunk events to use Star Trek "Stardate" time?

carasso
Splunk Employee
Splunk Employee

How can I get my Splunk events to use Star Trek "Stardate" time?

ENGAGE

A stardate is a date in the fictional system of time measurement developed for Star Trek, commonly heard at the beginning of a voiceover log entry such as "Captain's log, stardate 41153.7. Our destination is planet Deneb IV..." Writers and producers have selected numbers using different methods over the years, some more random than others, which makes it impossible to convert all stardates into equivalent calendar dates.

      http://en.wikipedia.org/wiki/Stardate
Tags (4)
1 Solution

carasso
Splunk Employee
Splunk Employee

The following series of eval commands calculate the Stardate in the field "star_date".
First it determines the year, the length of the year, and the proportion of the year that has gone by. Years are relative to year 2323.

< your search >
| eval year=strftime(_time, "%Y")
| eval leap = if((year % 4 == 0) and ((year % 100 != 0) or (year % 400 == 0)), "1", "0")
| eval length = if(leap=="1", 31622400, 31526000)
| eval time = _time - (60*date_zone) 
| eval year_date = relative_time(time,"@y")
| eval star_time =((time - year_date) * 1000 / length )
| eval star_year = year - 2323
| eval star_date = star_year.star_time 

There's an interesting bit of detail regarding timezones in that the snap-to-times in Splunk are local to your local timezone, meaning @y (the beginning of the year) is different for users in California and Russia. To compensate for that, we modify the 'time' value with the date_zone field.

This example is good for introducing eval, strftime, if(), and relative_time().

View solution in original post

carasso
Splunk Employee
Splunk Employee

The following series of eval commands calculate the Stardate in the field "star_date".
First it determines the year, the length of the year, and the proportion of the year that has gone by. Years are relative to year 2323.

< your search >
| eval year=strftime(_time, "%Y")
| eval leap = if((year % 4 == 0) and ((year % 100 != 0) or (year % 400 == 0)), "1", "0")
| eval length = if(leap=="1", 31622400, 31526000)
| eval time = _time - (60*date_zone) 
| eval year_date = relative_time(time,"@y")
| eval star_time =((time - year_date) * 1000 / length )
| eval star_year = year - 2323
| eval star_date = star_year.star_time 

There's an interesting bit of detail regarding timezones in that the snap-to-times in Splunk are local to your local timezone, meaning @y (the beginning of the year) is different for users in California and Russia. To compensate for that, we modify the 'time' value with the date_zone field.

This example is good for introducing eval, strftime, if(), and relative_time().

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...