Splunk Search

How to round down time to nearest 10th minute

sammyshinde14
New Member

Hi,
I want to convert my now() time to round down to nearest 10th minute.

For e.g.
If now returns 10:02 I want it to be converted to 10:00, if its, 10:18 then 10:10.

How can we achieve that?

0 Karma

Sukisen1981
Champion
| eval time=strftime((floor(now()/600))*600,"%Y-%m-%d %H:%M:%S")

Just adding on to @renjith.nair 's cddoe for minor time format issues

Sukisen1981
Champion

hi @sammyshinde14

If the solutions above worked out, please accept the answer , otherwise let us know what is the remaining issue

0 Karma

renjith_nair
Legend

@sammyshinde14 ,

Try

|eval time=(floor(now()/600))*600
---
What goes around comes around. If it helps, hit it with Karma 🙂
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...