How to search with time specified in milliseconds

[Daniel24]

I have two timestamps in milliseconds: start=1710525600000, end=1710532800000.

How can I search for logs between those timestamps? Let's say I want to run this query:

index=my_app
| search env=production
| search service=my-service

How to specify the time range in millis for this query?

[bowesmana]

Your examples are round seconds, but if you have epoch times to search between use the epoch with decimal places where required, so your example (which actually has no millisecond time) could be

index=my_app earliest=1710525600.000 latest=1710532800.000 env=production service=my-service

[Daniel24]

@bowesmana I'm autogenerating those milliseconds and I can't manipulate them. That's why I'm asking. I know that `earliest` and `latest` should be in seconds, but I have milliseconds as input.

[ITWhisperer]

It depends on how you are "auto-generating" them - you could possibly change the process that generates them to divide by 1000?

[Daniel24]

No, it's impossible to change the process, I don't control it. Is there any function in Splunk that can do this conversion? When I try earliest=timestamp/1000 it doesn't work.

[ITWhisperer]

So, it depends on how you are getting these values and including them in your search. Please provide more details. (You may be able to use Splunk to preprocess your values in a subsearch, but it depends where they come from.)

[Daniel24]

I can paste those values as URL parameters. So, I can have this URL as input:
https://my.splunkcloud.com/en-GB/app/my_app/search?q=search%20index%3Dkubernetes_app%20env%3Dproduct...

[bowesmana]

Can you change the URL in any way or is that all you have to make a search and there's no other component or processed in the middle

[Daniel24]

I can't change the values that I paste into the URL. I can change the parameters in the query, but not the values. I have that number of milliseconds and can't manipulate it.

[bowesmana · Accepted solution]

This format of the query params

q=search%20index%3D_audit%20%5B%20%7C%20makeresults%20%7C%20eval%20e%3D1710924016000%2Cl%3D1710927616000%2C%20earliest%3De%2F1000%2C%20latest%3Dl%2F1000%20%7C%20fields%20earliest%20latest%20%5D

is what is required to search the _audit index for 1 hour, so if you can construct the subsearch and set the e and l parameters as in 

%5B%20%7C%20makeresults%20%7C%20eval%20e%3D1710924016000%2Cl%3D1710927616000%2C%20earliest%3De%2F1000%2C%20latest%3Dl%2F1000%20%7C%20fields%20earliest%20latest%20%5D

it will do this search

index=_audit [ | makeresults | eval e=1710924016000,l=1710927616000, earliest=e/1000, latest=l/1000 | fields earliest latest ]

[Daniel24]

What does the whole query should look like? 

[bowesmana]

If you can change the URL parameters then you can create a subsearch that takes the ms parameters as parameters e and l. In the subsearch you can do the division and rename the fields earliest and latest. When passed out of the subsearch they will be treated as earliest and latest