Splunk Search

Change time field to show 'x' minutes ago?

zoebanning
Path Finder

Hello Splunk Community, 

I have a stats table I have created and I want to change the time field ("%Y-%m-%d %H:%M:%S") to present 'x' minutes ago. 

Can anyone help with this? 

Many Thanks, 

Zoe

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

The part you need is the now() - _time line below

| makeresults count=10
| eval _time=_time-(random() % (55 * 60))
| sort - _time
| eval mins=round(((now() - _time) / 60))." minutes ago"

this will round down the number of minutes. I'm assuming your time field is from the _time field, which is the epoch time in seconds, so just using the now() function to calculate the difference.

 

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Just add/substract needed number of seconds to adjust your timestamp.

For example, to "offset" all results by 10 minutes into the past do:

| eval _time=_time-600

 The question is - do you have the timestamp as timestamp (integer) or did you already render it to a string. If it's a string, you have to of course convert it to a timestamp with strptime or - even better - find earlier place in your spl pipeline when the timestamp was still nummerical and get your "source" timestamp from there.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

The part you need is the now() - _time line below

| makeresults count=10
| eval _time=_time-(random() % (55 * 60))
| sort - _time
| eval mins=round(((now() - _time) / 60))." minutes ago"

this will round down the number of minutes. I'm assuming your time field is from the _time field, which is the epoch time in seconds, so just using the now() function to calculate the difference.

 

zoebanning
Path Finder

Thank you! Worked out perfectly 🙂

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...