Splunk Search

How to add 5 seconds to a time value in strftime format using relative_time command?

C_Sparn
Communicator

Hello
I'm looking for a possibility to add 5 seconds to a time value that is in strftime format.
The crt eval is an example how I use the strftime format. Later it is used for earliest and latest like earliest = crt...

|eval crt = strftime(strptime(CreateTime,"%Y-%m-%d %H:%M:%S"),"%m/%d/%Y:%H:%M:%S")
|eval crt = relative_time(ct,"+5s")

The relative_time command is not working for me.
What am I doing wrong?

Greetings

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

relative_time() works with epoch timestamps, not formatted strings. Apply the five second change after strptime() and before strftime().

View solution in original post

strive
Influencer

martin_mueller
SplunkTrust
SplunkTrust

relative_time() works with epoch timestamps, not formatted strings. Apply the five second change after strptime() and before strftime().

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...