Splunk Search

Convert splunk time format to epoc time.

agoyal
Builder

Hi,

Can we convert splunk specific time to epoc time ?

For example:
-4h@h

I am using a search query in which one token have value like this causing failure of that query.

Query :

working fine : eventtype=mlc | eval _time = 3423423423 + relative_time
Not working : eventtype=mlc | eval _time = -4h@h + relative_time

Thanks

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

eventtype=mlc | eval _time = if(len(replace("$yourtoken$","\d",""))=0,$yourtoken$,relative_time(now(),"$yourtoken$")) + relative_time

Basically checking if the token value is all numbers (not relative time modifier) then use the token value OR use the relative time modifier value instead.

View solution in original post

0 Karma

woodcock
Esteemed Legend

You use the relative_time() function and the now() function.

0 Karma

somesoni2
Revered Legend

Try like this

eventtype=mlc | eval _time = if(len(replace("$yourtoken$","\d",""))=0,$yourtoken$,relative_time(now(),"$yourtoken$")) + relative_time

Basically checking if the token value is all numbers (not relative time modifier) then use the token value OR use the relative time modifier value instead.

View solution in original post

0 Karma

agoyal
Builder

Thank you @somesoni2. it helped me to fix the problem.
the below one worked fine.
eventtype=mlc | eval start_time = if(len(replace("$time_token.earliest$","\d",""))=0,"$time_token.earliest$",0) | eval _time = start_time + relative_time

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!