Splunk Search

Convert splunk time format to epoc time.

AKG1_old1
Builder

Hi,

Can we convert splunk specific time to epoc time ?

For example:
-4h@h

I am using a search query in which one token have value like this causing failure of that query.

Query :

working fine : eventtype=mlc | eval _time = 3423423423 + relative_time
Not working : eventtype=mlc | eval _time = -4h@h + relative_time

Thanks

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

eventtype=mlc | eval _time = if(len(replace("$yourtoken$","\d",""))=0,$yourtoken$,relative_time(now(),"$yourtoken$")) + relative_time

Basically checking if the token value is all numbers (not relative time modifier) then use the token value OR use the relative time modifier value instead.

View solution in original post

0 Karma

woodcock
Esteemed Legend

You use the relative_time() function and the now() function.

0 Karma

somesoni2
Revered Legend

Try like this

eventtype=mlc | eval _time = if(len(replace("$yourtoken$","\d",""))=0,$yourtoken$,relative_time(now(),"$yourtoken$")) + relative_time

Basically checking if the token value is all numbers (not relative time modifier) then use the token value OR use the relative time modifier value instead.

0 Karma

AKG1_old1
Builder

Thank you @somesoni2. it helped me to fix the problem.
the below one worked fine.
eventtype=mlc | eval start_time = if(len(replace("$time_token.earliest$","\d",""))=0,"$time_token.earliest$",0) | eval _time = start_time + relative_time

0 Karma
Get Updates on the Splunk Community!

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...