Time conversion & filter

[Karthikeyan]

Hi Experts,

I have created a search query to fetch details from Linux log and extracted a timestamp field and converted that with command strftime.

Timestamp from Linux log: 1628674387976621

| eval CT_time=strftime(Start_Time/pow(10,6),"%d/%m/%Y %H:%M:%S") 

Now I would like to filter the events based on converted time, like From CT_time to CT_time.

Please help with a query to filter with converted timestamp.

Regards, Karthikeyan.SV

[richgalloway]

Filtering events based on timestamps requires comparing timestamps, which is something Splunk cannot do with human-readable time strings.  Splunk compares times in integer form.