Splunk Enterprise

Compare usual time to Epoch time

luckyman80
Path Finder

Hi Experts! ,

                      Wondered if there was a way of doing this. I have a need to compare a timestamp of a log to an EPOCH time also on the same log line and show the Diff

Example

2021-10-05 04:49:10.138 [pool-1-thread-1] INFO order - [Pool]Book={inst=example,1=[],2=[feed-|time=1633427347600000000}

Manually looking the difference is 

2021-10-05 04:49:10.138 -(Standard time)

2021-10-05 04:49:07.600 -(EPOCH time)

Difference 2.54 seconds

Thanks in advance

Labels (1)
Tags (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

OK extract epoch like this

| rex "time=(?<epoch>\d*)"

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

Your base search| eva diff=_time-time | table diff
0 Karma

luckyman80
Path Finder
Spoiler
i did try that .. now I get 
_time as 2021-10-07 12:30:03.839

and diff as -1633624103220375800.000

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

Your base search | eval diff=abs(_time-(time/1000000000))

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Is your "standard" time already extracted as _time?

Your EPOCH time looks like it might be in nano-seconds, so try

| eval diff=_time-(epoch/1000000000)
0 Karma

luckyman80
Path Finder

Hi! Thanks for the quick response!  I haven't Extracted time yet (not sure how to do that) also how do I display it after ? sorry for all the questions 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You may find it has already been extracted for you when the events were indexed. What fields do you have extracted?

0 Karma

luckyman80
Path Finder

Apols if im being stupid . I tried 

| eval diff=_time-(epoch/1000000000)|table diff

but dont see anything 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What do you get if you just do 

<<your search>>
| table _time epoch
0 Karma

luckyman80
Path Finder

_time looks like this 

2021-10-07 08:28:04.211

epoch column  is blank 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

OK extract epoch like this

| rex "time=(?<epoch>\d*)"
0 Karma

luckyman80
Path Finder

thank you ! worked great 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...