Splunk Enterprise

Convert just the Time from _time to epoch


I've seen a lot of questions asking to get just the date from date/time stamp and convert to epoch. I want to do it for time.

eval Time=strptime(strftime(_time, "%H:%M:%S"), "%H:%M:%S")

I've tried this, but the date still seems to go with it. Epoch returns date with it. For instance, it returns 1491949028. I'm expecting a epoch value between 0 and 86400, where the date is 1/1/1970. My point is I want to determine if the date is between the hours of 8 AM and 5 PM.

0 Karma


The epoch will always contain date and time, as this is the definition of the epoch format. If you just want to evaluate the hours, you can use the following search string:

<your base search> | eval hours=strftime(_time,"%H") | where hours > 7 AND hours < 18
0 Karma


Wouldn't the date_hour field work for this?

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...