Convert just the Time from _time to epoch

[tmontney]

I've seen a lot of questions asking to get just the date from date/time stamp and convert to epoch. I want to do it for time.

eval Time=strptime(strftime(_time, "%H:%M:%S"), "%H:%M:%S")

I've tried this, but the date still seems to go with it. Epoch returns date with it. For instance, it returns 1491949028. I'm expecting a epoch value between 0 and 86400, where the date is 1/1/1970. My point is I want to determine if the date is between the hours of 8 AM and 5 PM.

[DMohn]

The epoch will always contain date and time, as this is the definition of the epoch format. If you just want to evaluate the hours, you can use the following search string:

<your base search> | eval hours=strftime(_time,"%H") | where hours > 7 AND hours < 18

[masonmorales]

Wouldn't the date_hour field work for this?