Splunk Search

How can I remove 4 hours from my search?

New Member

This is what I tried. The query runs but the hours are not removed.

index=sse_gdia_local_idx "starting from log" |eval fullload = trim(replace(fullload, "running CDC only in fresh start mode, starting from log position: 'timestamp:","")), fullload = trim(replace(fullload, "T", " ")),fullload = trim(replace(fullload, "'", " ")) |eval c_time2=relative_time(fullload, "-14400s") |eval c_time2=strftime(strptime(fullload,"%Y-%m-%d %H:%M:%S"),"%Y-%m-%d %H:%M:%S") 
0 Karma

SplunkTrust
SplunkTrust

relative_time expects an integer (epoch time) argument, but the fullload field is a string. Try this query. You may need to adjust the format string in the strptime call to match the exact format of fullload.

index=sse_gdia_local_idx "starting from log" | eval fullload = trim(replace(fullload, "running CDC only in fresh start mode, starting from log position: 'timestamp:","")) | eval epoch=strptime(fullload,"%Y-%m-%dT%H:%M:%S") - 14400 | eval c_time2=strftime(epoch, "%Y-%m-%d %H:%M:%S")
---
If this reply helps you, an upvote would be appreciated.
0 Karma

New Member

it didn't work. I figured it out. Here is the answer.

index=sse_gdia_local_idx "starting from log" |eval fullload = trim(replace(fullload, "running CDC only in fresh start mode, starting from log position: 'timestamp:","")), fullload = trim(replace(fullload, "T", " ")),fullload = trim(replace(fullload, "'", " ")) |eval c_time2=strptime(fullload,"%Y-%m-%d %H:%M:%S")-14400,c_time2 = strftime(c_time2,"%Y-%m-%d %H:%M:%S")
0 Karma

New Member

fullload comes out a value but c_time2 comes out blank.

0 Karma

SplunkTrust
SplunkTrust

There were some typos in the query. I've updated my answer.

---
If this reply helps you, an upvote would be appreciated.
0 Karma