Splunk Search

Convert splunk time format to epoc time.

AKG1_old1
Builder

Hi,

Can we convert splunk specific time to epoc time ?

For example:
-4h@h

I am using a search query in which one token have value like this causing failure of that query.

Query :

working fine : eventtype=mlc | eval _time = 3423423423 + relative_time
Not working : eventtype=mlc | eval _time = -4h@h + relative_time

Thanks

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

eventtype=mlc | eval _time = if(len(replace("$yourtoken$","\d",""))=0,$yourtoken$,relative_time(now(),"$yourtoken$")) + relative_time

Basically checking if the token value is all numbers (not relative time modifier) then use the token value OR use the relative time modifier value instead.

View solution in original post

0 Karma

woodcock
Esteemed Legend

You use the relative_time() function and the now() function.

0 Karma

somesoni2
Revered Legend

Try like this

eventtype=mlc | eval _time = if(len(replace("$yourtoken$","\d",""))=0,$yourtoken$,relative_time(now(),"$yourtoken$")) + relative_time

Basically checking if the token value is all numbers (not relative time modifier) then use the token value OR use the relative time modifier value instead.

0 Karma

AKG1_old1
Builder

Thank you @somesoni2. it helped me to fix the problem.
the below one worked fine.
eventtype=mlc | eval start_time = if(len(replace("$time_token.earliest$","\d",""))=0,"$time_token.earliest$",0) | eval _time = start_time + relative_time

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...