Splunk Search

How to convert Unix format and compare it with _time for given values of `savedsearch_name` and have a clear visualization


I am trying to visualize the deviation between a correlation rule's scheduled time and the time it was run.
went through the index=_internal sourcetype=scheduler
and found the scheduled time in Unix timestamp format.

How can I convert Unix format and compare it with _time for given values of savedsearch_name and have a clear visualization (to present it for management)

0 Karma

Ultra Champion
your search
|eval my_time= _time

Hi, @mo_shahin
try this, and check my_time. It is unnecessary to convert to Unix timestamp format.

and, Visualization....

index=_internal sourcetype=scheduler
| eval diff=_time - savedsearch_name
| table _time diff

try Line Chart

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...