Splunk Search

How can I remove 4 hours from my search?

rgarbac1
New Member

This is what I tried. The query runs but the hours are not removed.

index=sse_gdia_local_idx "starting from log" |eval fullload = trim(replace(fullload, "running CDC only in fresh start mode, starting from log position: 'timestamp:","")), fullload = trim(replace(fullload, "T", " ")),fullload = trim(replace(fullload, "'", " ")) |eval c_time2=relative_time(fullload, "-14400s") |eval c_time2=strftime(strptime(fullload,"%Y-%m-%d %H:%M:%S"),"%Y-%m-%d %H:%M:%S") 
0 Karma

richgalloway
SplunkTrust
SplunkTrust

relative_time expects an integer (epoch time) argument, but the fullload field is a string. Try this query. You may need to adjust the format string in the strptime call to match the exact format of fullload.

index=sse_gdia_local_idx "starting from log" | eval fullload = trim(replace(fullload, "running CDC only in fresh start mode, starting from log position: 'timestamp:","")) | eval epoch=strptime(fullload,"%Y-%m-%dT%H:%M:%S") - 14400 | eval c_time2=strftime(epoch, "%Y-%m-%d %H:%M:%S")
---
If this reply helps you, Karma would be appreciated.
0 Karma

rgarbac1
New Member

it didn't work. I figured it out. Here is the answer.

index=sse_gdia_local_idx "starting from log" |eval fullload = trim(replace(fullload, "running CDC only in fresh start mode, starting from log position: 'timestamp:","")), fullload = trim(replace(fullload, "T", " ")),fullload = trim(replace(fullload, "'", " ")) |eval c_time2=strptime(fullload,"%Y-%m-%d %H:%M:%S")-14400,c_time2 = strftime(c_time2,"%Y-%m-%d %H:%M:%S")
0 Karma

rgarbac1
New Member

fullload comes out a value but c_time2 comes out blank.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There were some typos in the query. I've updated my answer.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...