Splunk Search

How can I manage relative time values passed from a time input and convert to epoch time?

andrewtrobec
Motivator

Hello,

I would like to convert all possible values set in a time input to epoch time format. This means that it should manage values like:

-d@d @w now

i have found similar threads like this which recommend the relative_time() function, but it doesn't manage all cases. I also found a thread about filtering all values in a time input within a search:

| where if("$time_input.earliest$"!="0" AND "$time_input.earliest$"!="",_time>=if(replace("$time_input.earliest$","\d","")!="",relative_time(now(),if("$time_input.earliest$"="now","-0m","$time_input.earliest$")),"$time_input.earliest$"),0=0) AND if("$time_input.latest$"!="0" AND "$time_input.latest$"!="",_time<if(replace("$time_input.latest$","\d","")!="",relative_time(now(),if("$time_input.latest$"="now","-0m","$time_input.latest$")),"$time_input.latest$"),0=0)

but I cannot figure out how to convert this for use in an eval

Could somebody help me out?

Thank you and best regards,

Andrew

Tags (1)
0 Karma
1 Solution

elliotproebstel
Champion

Is the timepicker being used to set the parameters of the search? If so, you can do this:

| addinfo
| eval early_time=info_min_time, late_time=info_max_time

And if you don't like having the extra info* fields, you can follow that with:

| fields - info_max_time info_min_time info_search_time info_sid

View solution in original post

elliotproebstel
Champion

Is the timepicker being used to set the parameters of the search? If so, you can do this:

| addinfo
| eval early_time=info_min_time, late_time=info_max_time

And if you don't like having the extra info* fields, you can follow that with:

| fields - info_max_time info_min_time info_search_time info_sid

andrewtrobec
Motivator

@elliotproebstel this is perfect! No conversions required!

0 Karma

elliotproebstel
Champion

Great! I converted it to an answer so you can accept it to help others find it in the future. :slightly_smiling_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...