Splunk Search

How to subtract a static number (e.g.. minutes, hours, seconds) from a timestamp?

jclemons7
Path Finder

Hello,

I have a timestamp formatted as 2015-10-14T10:04:47.962Z and I'd like to add or subtract a fixed number of minutes from it. I've tried things similar to timestamp-5m and stuff that I'm too embarrassed to put here, to no avail. Your help is GREATLY appreciated.

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There are two ways to do that (perhaps others will have more), but both require the timestamp be converted to epoch time first.

... | eval ts=strptime(timestamp, "%Y-%m-%dT%H:%M:%S.%3N%Z") | eval newts=ts-300 | ...

... | eval ts=strptime(timestamp, "%Y-%m-%dT%H:%M:%S.%3N%Z") | eval newts=relative_time(ts, -5m) | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

There are two ways to do that (perhaps others will have more), but both require the timestamp be converted to epoch time first.

... | eval ts=strptime(timestamp, "%Y-%m-%dT%H:%M:%S.%3N%Z") | eval newts=ts-300 | ...

... | eval ts=strptime(timestamp, "%Y-%m-%dT%H:%M:%S.%3N%Z") | eval newts=relative_time(ts, -5m) | ...
---
If this reply helps you, Karma would be appreciated.

gabrell
New Member

Hi, how can I convert this format of Time?

start time: 2015-12-13T23:55:02+00:00
end time : 2015-12-15T23:55:02+00:00

And then I need to get the time taken from start to end TMA = (Start time - End Time) | table TMA

Can you help me out?

Thanks.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please post a new question.

---
If this reply helps you, Karma would be appreciated.
0 Karma

jclemons7
Path Finder

Your answer worked, but it dawned on me that I already had the value in epoch.. so I just did this

| eval ts=(_time - (5 * 60))  | ..... 
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...