Splunk Enterprise

Compare usual time to Epoch time

luckyman80
Path Finder

Hi Experts! ,

                      Wondered if there was a way of doing this. I have a need to compare a timestamp of a log to an EPOCH time also on the same log line and show the Diff

Example

2021-10-05 04:49:10.138 [pool-1-thread-1] INFO order - [Pool]Book={inst=example,1=[],2=[feed-|time=1633427347600000000}

Manually looking the difference is 

2021-10-05 04:49:10.138 -(Standard time)

2021-10-05 04:49:07.600 -(EPOCH time)

Difference 2.54 seconds

Thanks in advance

Labels (1)
Tags (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

OK extract epoch like this

| rex "time=(?<epoch>\d*)"

View solution in original post

0 Karma

somesoni2
Revered Legend

Try this

Your base search| eva diff=_time-time | table diff
0 Karma

luckyman80
Path Finder
Spoiler
i did try that .. now I get 
_time as 2021-10-07 12:30:03.839

and diff as -1633624103220375800.000

0 Karma

somesoni2
Revered Legend

Try this

Your base search | eval diff=abs(_time-(time/1000000000))

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Is your "standard" time already extracted as _time?

Your EPOCH time looks like it might be in nano-seconds, so try

| eval diff=_time-(epoch/1000000000)
0 Karma

luckyman80
Path Finder

Hi! Thanks for the quick response!  I haven't Extracted time yet (not sure how to do that) also how do I display it after ? sorry for all the questions 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You may find it has already been extracted for you when the events were indexed. What fields do you have extracted?

0 Karma

luckyman80
Path Finder

Apols if im being stupid . I tried 

| eval diff=_time-(epoch/1000000000)|table diff

but dont see anything 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What do you get if you just do 

<<your search>>
| table _time epoch
0 Karma

luckyman80
Path Finder

_time looks like this 

2021-10-07 08:28:04.211

epoch column  is blank 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

OK extract epoch like this

| rex "time=(?<epoch>\d*)"
0 Karma

luckyman80
Path Finder

thank you ! worked great 

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...