This is what I tried. The query runs but the hours are not removed.
index=sse_gdia_local_idx "starting from log" |eval fullload = trim(replace(fullload, "running CDC only in fresh start mode, starting from log position: 'timestamp:","")), fullload = trim(replace(fullload, "T", " ")),fullload = trim(replace(fullload, "'", " ")) |eval c_time2=relative_time(fullload, "-14400s") |eval c_time2=strftime(strptime(fullload,"%Y-%m-%d %H:%M:%S"),"%Y-%m-%d %H:%M:%S")
relative_time
expects an integer (epoch time) argument, but the fullload field is a string. Try this query. You may need to adjust the format string in the strptime
call to match the exact format of fullload.
index=sse_gdia_local_idx "starting from log" | eval fullload = trim(replace(fullload, "running CDC only in fresh start mode, starting from log position: 'timestamp:","")) | eval epoch=strptime(fullload,"%Y-%m-%dT%H:%M:%S") - 14400 | eval c_time2=strftime(epoch, "%Y-%m-%d %H:%M:%S")
it didn't work. I figured it out. Here is the answer.
index=sse_gdia_local_idx "starting from log" |eval fullload = trim(replace(fullload, "running CDC only in fresh start mode, starting from log position: 'timestamp:","")), fullload = trim(replace(fullload, "T", " ")),fullload = trim(replace(fullload, "'", " ")) |eval c_time2=strptime(fullload,"%Y-%m-%d %H:%M:%S")-14400,c_time2 = strftime(c_time2,"%Y-%m-%d %H:%M:%S")
fullload comes out a value but c_time2 comes out blank.
There were some typos in the query. I've updated my answer.