Getting Data In

Time conversion & filter


Hi Experts,


I have created a search query to fetch details from Linux log and extracted a timestamp field and converted that with command strftime.

Timestamp from Linux log: 1628674387976621

| eval CT_time=strftime(Start_Time/pow(10,6),"%d/%m/%Y %H:%M:%S") 

Now I would like to filter the events based on converted time, like From CT_time to CT_time.


Please help with a query to filter with converted timestamp.


Regards, Karthikeyan.SV

Labels (1)
0 Karma


Filtering events based on timestamps requires comparing timestamps, which is something Splunk cannot do with human-readable time strings.  Splunk compares times in integer form.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...