Adding seconds to _time

[ChhayaV]

hi,

I want to add some seconds in the current _time.
Is there any build in function for it?

e.g_time=23:03:39.022
after adding 4.90 seocnds it should be 23:03:43.936

Thanks

[Ayn]

_time is actually in epoch format, Splunk just converts the format automatically before showing it to you so that it's human readable. So, to add 4 seconds, just do eval _time=_time+4.

Note that this is purely a search-time operation - if you want to do this at index-time the problem is much more complex because functions for performing arithmetic etc are not available.

[sowings]

This works, and gives milliseconds:

convert timeformat="%Y/%m/%d %H:%M:%S.%3N" ctime(_time) AS timestr

What did you try that didn't work?

[ChhayaV]

already tried

[kristian_kolb]

shouldn't the expected outcome be 23:03:39.846 ?

and for strftime/strptime, %3N, %6N are the variables for milli- and microseconds, respectively.

http://docs.splunk.com/Documentation/Splunk/5.0.5/SearchReference/Commontimeformatvariables

[ChhayaV]

hi
input time: 23:03:43.936
after subtracting 4.09
expected output time: 23:03:39.022

but output time is 23:03:39

i gave %ms after %S but not working and when i export it to CSV time column is not proper it show ### in the column

[sowings]

Your time format output truncates to seconds. You'll need to add some placeholder in the format string for milli / microseconds.

[Ayn]

Explain more clearly. What do you mean by not being able to see milliseconds? What are you expecting to see, and what are you not seeing?

[ChhayaV]

got it ..but i am not able to see milliseconds

index=tm_idx host="server" index=tm_idx host="server" "finished executing normally" | rex field=_raw "(?i)Process\s(\"|\"})(?\w+)" | rex field=_raw "elapsed\stime\s(?\w+.\w+)\sseconds" | eval time=_time-myduration| convert timeformat="%m/%d/%Y %H:%M:%S" ctime(time) as timestr |table _time timestr _raw myduration

this is my search

[Ayn]

Yup. Epoch is just seconds, so add how many seconds you want.

[ChhayaV]

if it is 200 seconds then resulted output time should also have minutes modified