Splunk Enterprise

Compare usual time to Epoch time

luckyman80
Path Finder

Hi Experts! ,

                      Wondered if there was a way of doing this. I have a need to compare a timestamp of a log to an EPOCH time also on the same log line and show the Diff

Example

2021-10-05 04:49:10.138 [pool-1-thread-1] INFO order - [Pool]Book={inst=example,1=[],2=[feed-|time=1633427347600000000}

Manually looking the difference is 

2021-10-05 04:49:10.138 -(Standard time)

2021-10-05 04:49:07.600 -(EPOCH time)

Difference 2.54 seconds

Thanks in advance

Labels (1)
Tags (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

OK extract epoch like this

| rex "time=(?<epoch>\d*)"

View solution in original post

0 Karma

somesoni2
Revered Legend

Try this

Your base search| eva diff=_time-time | table diff
0 Karma

luckyman80
Path Finder
Spoiler
i did try that .. now I get 
_time as 2021-10-07 12:30:03.839

and diff as -1633624103220375800.000

0 Karma

somesoni2
Revered Legend

Try this

Your base search | eval diff=abs(_time-(time/1000000000))

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Is your "standard" time already extracted as _time?

Your EPOCH time looks like it might be in nano-seconds, so try

| eval diff=_time-(epoch/1000000000)
0 Karma

luckyman80
Path Finder

Hi! Thanks for the quick response!  I haven't Extracted time yet (not sure how to do that) also how do I display it after ? sorry for all the questions 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You may find it has already been extracted for you when the events were indexed. What fields do you have extracted?

0 Karma

luckyman80
Path Finder

Apols if im being stupid . I tried 

| eval diff=_time-(epoch/1000000000)|table diff

but dont see anything 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What do you get if you just do 

<<your search>>
| table _time epoch
0 Karma

luckyman80
Path Finder

_time looks like this 

2021-10-07 08:28:04.211

epoch column  is blank 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

OK extract epoch like this

| rex "time=(?<epoch>\d*)"

View solution in original post

0 Karma

luckyman80
Path Finder

thank you ! worked great 

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!