Splunk Search

How can I remove 4 hours from my search?

rgarbac1
New Member

This is what I tried. The query runs but the hours are not removed.

index=sse_gdia_local_idx "starting from log" |eval fullload = trim(replace(fullload, "running CDC only in fresh start mode, starting from log position: 'timestamp:","")), fullload = trim(replace(fullload, "T", " ")),fullload = trim(replace(fullload, "'", " ")) |eval c_time2=relative_time(fullload, "-14400s") |eval c_time2=strftime(strptime(fullload,"%Y-%m-%d %H:%M:%S"),"%Y-%m-%d %H:%M:%S") 
0 Karma

richgalloway
SplunkTrust
SplunkTrust

relative_time expects an integer (epoch time) argument, but the fullload field is a string. Try this query. You may need to adjust the format string in the strptime call to match the exact format of fullload.

index=sse_gdia_local_idx "starting from log" | eval fullload = trim(replace(fullload, "running CDC only in fresh start mode, starting from log position: 'timestamp:","")) | eval epoch=strptime(fullload,"%Y-%m-%dT%H:%M:%S") - 14400 | eval c_time2=strftime(epoch, "%Y-%m-%d %H:%M:%S")
---
If this reply helps you, Karma would be appreciated.
0 Karma

rgarbac1
New Member

it didn't work. I figured it out. Here is the answer.

index=sse_gdia_local_idx "starting from log" |eval fullload = trim(replace(fullload, "running CDC only in fresh start mode, starting from log position: 'timestamp:","")), fullload = trim(replace(fullload, "T", " ")),fullload = trim(replace(fullload, "'", " ")) |eval c_time2=strptime(fullload,"%Y-%m-%d %H:%M:%S")-14400,c_time2 = strftime(c_time2,"%Y-%m-%d %H:%M:%S")
0 Karma

rgarbac1
New Member

fullload comes out a value but c_time2 comes out blank.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There were some typos in the query. I've updated my answer.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...