Convert earliest_time latest_time notation to epoch

[D2SI]

Hello there!

Is there a known method (a function, a command, built-in or custom, a search trick) to convert the earliest_time and latest_time notation to epoch for instance?

For instance, I need to convert this:

earliest_time
-15m@m

latest_time
-5m@m

into an epoch timestamp so I can calculate the interval between them.

As the notation is flexible, I want to check if there is something available already rather than try to build a dirty search that would try to cover every variation of the notation.

Thanks in advance for any hint!

[richgalloway · Accepted solution]

Use the relative_time function as in this run-anywhere example.

| makeresults 
| eval now=now(), interval="-15m@m", ago=relative_time(now, interval) 
| table now, interval, ago

[D2SI]

Thanks a lot!