Getting Data In

How do I convert these timestamps to epoch?

kmccowen
Path Finder

Need help converting these times to epoch so that I can do a DIFF between them.

branchExecutionStartTime=Wed Jul 06 09:21:22 CDT 2016
branchExecutionEndTime=Wed Jul 06 09:21:22 CDT 2016

Can anyone help?

Tags (3)
0 Karma
1 Solution

kbarker302
Communicator

See the answer posted here:

https://answers.splunk.com/answers/114818/find-the-difference-between-two-date-time-values.html

I tweaked the code sample from the above post to match the date format example you provided:

your_base_search |
| eval branchExecutionStartTime="Wed Jul 06 09:21:22 CDT 2016"
| eval branchExecutionEndTime="Wed Jul 06 09:21:22 CDT 2016"
| eval it = strptime(branchExecutionStartTime, "%a %b %e %H:%M:%S %Z %Y") 
| eval ot = strptime(branchExecutionEndTime, "%a %b %e %H:%M:%S %Z %Y") 
| eval diff = tostring((ot - it), "duration") 
| table in_time, out_time, diff 

For reference, below are the various date/time format variables Splunk uses:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables

View solution in original post

somesoni2
Revered Legend
0 Karma

kbarker302
Communicator

See the answer posted here:

https://answers.splunk.com/answers/114818/find-the-difference-between-two-date-time-values.html

I tweaked the code sample from the above post to match the date format example you provided:

your_base_search |
| eval branchExecutionStartTime="Wed Jul 06 09:21:22 CDT 2016"
| eval branchExecutionEndTime="Wed Jul 06 09:21:22 CDT 2016"
| eval it = strptime(branchExecutionStartTime, "%a %b %e %H:%M:%S %Z %Y") 
| eval ot = strptime(branchExecutionEndTime, "%a %b %e %H:%M:%S %Z %Y") 
| eval diff = tostring((ot - it), "duration") 
| table in_time, out_time, diff 

For reference, below are the various date/time format variables Splunk uses:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...