Can we convert splunk specific time to epoc time ?
I am using a search query in which one token have value like this causing failure of that query.
working fine : eventtype=mlc | eval _time = 3423423423 + relative_time
Not working : eventtype=mlc | eval _time = -4h@h + relative_time
Try like this
eventtype=mlc | eval _time = if(len(replace("$yourtoken$","\d",""))=0,$yourtoken$,relative_time(now(),"$yourtoken$")) + relative_time
Basically checking if the token value is all numbers (not relative time modifier) then use the token value OR use the relative time modifier value instead.
View solution in original post
You use the relative_time() function and the now() function.
Thank you @somesoni2. it helped me to fix the problem.
the below one worked fine.
eventtype=mlc | eval start_time = if(len(replace("$time_token.earliest$","\d",""))=0,"$time_token.earliest$",0) | eval _time = start_time + relative_time