How can I remove 4 hours from my search?

[rgarbac1]

This is what I tried. The query runs but the hours are not removed.

index=sse_gdia_local_idx "starting from log" |eval fullload = trim(replace(fullload, "running CDC only in fresh start mode, starting from log position: 'timestamp:","")), fullload = trim(replace(fullload, "T", " ")),fullload = trim(replace(fullload, "'", " ")) |eval c_time2=relative_time(fullload, "-14400s") |eval c_time2=strftime(strptime(fullload,"%Y-%m-%d %H:%M:%S"),"%Y-%m-%d %H:%M:%S") 

[richgalloway]

relative_time expects an integer (epoch time) argument, but the fullload field is a string. Try this query. You may need to adjust the format string in the strptime call to match the exact format of fullload.

index=sse_gdia_local_idx "starting from log" | eval fullload = trim(replace(fullload, "running CDC only in fresh start mode, starting from log position: 'timestamp:","")) | eval epoch=strptime(fullload,"%Y-%m-%dT%H:%M:%S") - 14400 | eval c_time2=strftime(epoch, "%Y-%m-%d %H:%M:%S")

[rgarbac1]

it didn't work. I figured it out. Here is the answer.

index=sse_gdia_local_idx "starting from log" |eval fullload = trim(replace(fullload, "running CDC only in fresh start mode, starting from log position: 'timestamp:","")), fullload = trim(replace(fullload, "T", " ")),fullload = trim(replace(fullload, "'", " ")) |eval c_time2=strptime(fullload,"%Y-%m-%d %H:%M:%S")-14400,c_time2 = strftime(c_time2,"%Y-%m-%d %H:%M:%S")

[rgarbac1]

fullload comes out a value but c_time2 comes out blank.

[richgalloway]

There were some typos in the query. I've updated my answer.