Getting Data In

Time conversion & filter

Karthikeyan
Engager

Hi Experts,

 

I have created a search query to fetch details from Linux log and extracted a timestamp field and converted that with command strftime.

Timestamp from Linux log: 1628674387976621

| eval CT_time=strftime(Start_Time/pow(10,6),"%d/%m/%Y %H:%M:%S") 

Now I would like to filter the events based on converted time, like From CT_time to CT_time.

 

Please help with a query to filter with converted timestamp.

 

Regards, Karthikeyan.SV

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Filtering events based on timestamps requires comparing timestamps, which is something Splunk cannot do with human-readable time strings.  Splunk compares times in integer form.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...