- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello
I'm looking for a possibility to add 5 seconds to a time value that is in strftime format.
The crt eval is an example how I use the strftime format. Later it is used for earliest and latest like earliest = crt...
|eval crt = strftime(strptime(CreateTime,"%Y-%m-%d %H:%M:%S"),"%m/%d/%Y:%H:%M:%S")
|eval crt = relative_time(ct,"+5s")
The relative_time command is not working for me.
What am I doing wrong?
Greetings
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

relative_time()
works with epoch timestamps, not formatted strings. Apply the five second change after strptime()
and before strftime()
.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

you should give epoch time
http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/Commonevalfunctions
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

relative_time()
works with epoch timestamps, not formatted strings. Apply the five second change after strptime()
and before strftime()
.
