Splunk Enterprise

Compare usual time to Epoch time

luckyman80
Path Finder

Hi Experts! ,

                      Wondered if there was a way of doing this. I have a need to compare a timestamp of a log to an EPOCH time also on the same log line and show the Diff

Example

2021-10-05 04:49:10.138 [pool-1-thread-1] INFO order - [Pool]Book={inst=example,1=[],2=[feed-|time=1633427347600000000}

Manually looking the difference is 

2021-10-05 04:49:10.138 -(Standard time)

2021-10-05 04:49:07.600 -(EPOCH time)

Difference 2.54 seconds

Thanks in advance

Labels (1)
Tags (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

OK extract epoch like this

| rex "time=(?<epoch>\d*)"

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

Your base search| eva diff=_time-time | table diff
0 Karma

luckyman80
Path Finder
Spoiler
i did try that .. now I get 
_time as 2021-10-07 12:30:03.839

and diff as -1633624103220375800.000

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

Your base search | eval diff=abs(_time-(time/1000000000))

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Is your "standard" time already extracted as _time?

Your EPOCH time looks like it might be in nano-seconds, so try

| eval diff=_time-(epoch/1000000000)
0 Karma

luckyman80
Path Finder

Hi! Thanks for the quick response!  I haven't Extracted time yet (not sure how to do that) also how do I display it after ? sorry for all the questions 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You may find it has already been extracted for you when the events were indexed. What fields do you have extracted?

0 Karma

luckyman80
Path Finder

Apols if im being stupid . I tried 

| eval diff=_time-(epoch/1000000000)|table diff

but dont see anything 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What do you get if you just do 

<<your search>>
| table _time epoch
0 Karma

luckyman80
Path Finder

_time looks like this 

2021-10-07 08:28:04.211

epoch column  is blank 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

OK extract epoch like this

| rex "time=(?<epoch>\d*)"
0 Karma

luckyman80
Path Finder

thank you ! worked great 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...