Splunk Enterprise

Convert just the Time from _time to epoch


I've seen a lot of questions asking to get just the date from date/time stamp and convert to epoch. I want to do it for time.

eval Time=strptime(strftime(_time, "%H:%M:%S"), "%H:%M:%S")

I've tried this, but the date still seems to go with it. Epoch returns date with it. For instance, it returns 1491949028. I'm expecting a epoch value between 0 and 86400, where the date is 1/1/1970. My point is I want to determine if the date is between the hours of 8 AM and 5 PM.

0 Karma


The epoch will always contain date and time, as this is the definition of the epoch format. If you just want to evaluate the hours, you can use the following search string:

<your base search> | eval hours=strftime(_time,"%H") | where hours > 7 AND hours < 18
0 Karma


Wouldn't the date_hour field work for this?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!