How to add time to an event

[Mary666]

Hello Splunk Community,

I have read through the Q&A 7 pages in and read through several instructions on how to do this, but still cant seem to find what I need to do. I am trying to add 1 hr and 15 min to the event latestEvent. Can obtain some guidance on how to add 1 hr and 15 min to a field? In this case the filed is latestEvent. 

(index="xyz" event=submission ) OR (index="abc )
| eval latestEvent=case(event="submission", timeofsub)
| eval Scheduled_Ingestion_Time=relative_time(latestEvent, "+3615")
| stats  latest(latestEvent) as latestEvent values(Scheduled_Ingestion_Time) as Scheduled_Ingestion_Time  

[tscroggins]

@Mary666 

Timestamp fields like _time are integer Unix epoch values: the number of seconds elapsed since January 1, 1970 12:00 AM.

To add 1 hr and 15 min to a time field, add 4500 seconds:

| eval Scheduled_Ingestion_Time=latestEvent + 4500

If latestEvent isn't a time field, you'll need to convert it to one using whatever method is appropriate for your data. For example, if latestEvent is the string "2021-03-05 00:00:00" you would use:

| eval Scheduled_Ingestion_Time=strptime(latestEvent, "%F %T") + 4500

[Mary666]

Hi tscroggins,

Thanks for your quick reply. I tried your recommendation and it helped using | eval Scheduled_Ingestion_Time=strptime(latestEvent, "%F %T") + 4500 , but I have a question:

1.  I only seem to get results in epoch time example: 

The time  I get is:  1613751347.000000
But I would like to convert it to Unix: 2021-02-19 07:00:47.089586 

I have tried using  | eval Scheduled_Ingestion_Time=strptime(latestArchive,"%Y-%m-%d %H:%M:%S.%3N") + 4500

Still get epoch time though.  Any guidance on how to tackle this will greatly help. 

[tscroggins · Accepted solution]

@Mary666 

You have a few options, but the two simplest ones are:

To convert the field back to a string:

| eval Scheduled_Ingestion_Time=strftime(strptime(latestArchive, "%Y-%m-%d %H:%M:%S.%3N") + 4500, "%Y-%m-%d %H:%M:%S.%3N")

To leave the field an integer but display it as a string:

| eval Scheduled_Ingestion_Time=strptime(latestArchive, "%Y-%m-%d %H:%M:%S.%3N") + 4500

| fieldformat Scheduled_Ingestion_Time=strftime(Scheduled_Ingestion_Time, "%Y-%m-%d %H:%M:%S.%3N")

The time function names can be read as "string from time" and "string parse time."

[Mary666]

Thanks, 

| eval Scheduled_Ingestion_Time=strftime(strptime(latestArchive, "%Y-%m-%d %H:%M:%S.%3N") + 4500, "%Y-%m-%d %H:%M:%S.%3N") 

Did the trick 🙂