Splunk Search

How do I create a time field?


I have the EVENT_TIMESTAMP_UTC field with the values of -


2020-11-19 13:50:08.393085
2020-11-19 13:50:08.3517
2020-11-19 13:50:08.306023
2020-11-19 13:50:08.238995
2020-11-19 13:50:08.16885


I would like to create a new time field and treat the data as in the UTC time-zone. 

Labels (1)
Tags (1)

Ultra Champion

hi @inventsekar 
I thought the log was JSON, so I started by making the multi-value to single.
We can use rex with max_match and do it all at once with mvmap.

If it was a single value, rex and eval are enough.

Ultra Champion
| makeresults
| eval EVENT_TIMESTAMP_UTC=split("2020-11-19 13:50:08.393085,2020-11-19 13:50:08.3517,2020-11-19 13:50:08.306023,2020-11-19 13:50:08.238995,2020-11-19 13:50:08.16885",",")
| rename COMMENT as "the logic" 
| rex field=EVENT_TIMESTAMP_UTC "(?<data>\d[\w\-: ]+)\.(?<msecond>\d+)"
| eval msecond=printf("%06d",msecond)
| eval EVENT_TIMESTAMP_UTC=strptime(data.msecond,"%F %T%6Q")

Super Champion

Great query @to4kawa ... i need to learn lot of stuff from your search queries!

but could you pls explain us the context here.. i got confused with this request... the question says "I have the EVENT_TIMESTAMP_UTC field"... 
then  why "treat the data as in the UTC time-zone" ?!?!

0 Karma
Get Updates on the Splunk Community!

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...