(index=unix) (sourcetype="web") | eval Time.atFirewall=DateOutbound-DateInbound | eval Time.atDataCentre=strptime(indextime,"yyyy-MM-dd'T'HH:mm:ss.SSSZ") | eval Time.SendGrid=Time.atDataCentre-DateInbound | table indextime DateInbound DateOutbound Time.atFirewall Time.atDataCentre
I get this in search:
Error in 'eval' command: Typechecking failed. '-' only takes numbers.
DateOutbound & DateInbound are Epoch Time fields, and I wanted to convert index time to Epoch to do the maths. It seems that Time.atDataCentre is not assigned an Epoch time value, it's not a number, hence the Error message from Splunk. I am following the documentation on strptime, so puzzled.
Anyone ever convert long date / Zulu date to Epoch time?
A few of things:
Hope this helps
Your strptime() format string is incorrect. You probably want something like
strptime(index_time,"%Y-%m-%dT%H:%M:%S.%3NZ"). See aholzer's comment for a link to the docs.