How to get current time and convert to epoch

[jbv]

Hi,

Is there a way to get current time on Splunk and then convert it to epoch? Im trying to create a dashboard to show inactivity from my data sources and plan to use info from | metadata command.

[gcusello · Accepted solution]

Hi @jbv ,

you can use the now() funtion, for more infos see at https://docs.splunk.com/Documentation/SCS/current/SearchReference/DateandTimeFunctions

You can try something like this:

| makeresults
| eval current_time=now()
| table current_time

it's in epochtime, then you can convert in the format you like.

Ciao.

Giuseppe

[gcusello]

Hi @jbv ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[tej57]

Hello @jbv,

You can get the current time using the now() function. By default it is returned in epoch  format only. You can use eval to call a field and you'll get what you want.

| eval current_time_epoch=now()

Thanks,
Tejas.

---

If the above solution helps, an upvote is appreciated.!! 

[ITWhisperer]

There are a couple of functions to returns time, now() which returns the time the search started, and time() which returns the time the function is executed. Both of these functions already return the time in epoch format.