Splunk Enterprise Security
Highlighted

how to convert the day into seconds splunk search query

New Member

25days convert to seconds and
difference with current time to seconds and display the difference time

0 Karma
Highlighted

Re: how to convert the day into seconds splunk search query

SplunkTrust
SplunkTrust

I see several questions there.

1) Convert 25 days into seconds: | eval 25days = 25 * 86400
2) Convert current time to seconds: | eval now = now()
3) Display the difference between now and 25 days ago: | eval diff = now() - relative_time(now(), "-25d")

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: how to convert the day into seconds splunk search query

Influencer

25days convert to seconds and difference with current time to seconds gives 252460*60 which is 25 days. If you need epoch value of day that is 25 days ago from current time then use relative time.

| makeresults 
| eval 25daysago_epoch=relative_time(now(), "-25d"), 25daysago_datetime=strftime('25daysago_epoch', "%d-%m-%Y %H:%M:%S"), current_time=strftime(_time, "%d-%m-%Y %H:%M:%S")
| table current_time, 25daysago_datetime, 25daysago_epoch
0 Karma
Highlighted

Re: how to convert the day into seconds splunk search query

New Member

alt text

I need ans this format please

0 Karma