Splunk Search

Increasing TIMESTAMP by adding seconds.

jlhamlet
Path Finder

Hi,

I have a proxy log that logs the time the query was executed and also give the duration in seconds.

"11/Jan/2014:00:45:32.755 +0200" - - 1xx.1xx.1xx.43:0 0 - - 3226 "-"

I would like to "add" the seconds (3326) to the timestamp so that i can create a table with:
Start_time = 00:45:32
End time = "00:45:32" + "3336"

To sum up: End_Time should be START_TIME + SECONDS.

Hope i am clear on the explanation.

Thank you for your help

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Are you sure that's not in milliseconds?

0 Karma

Richfez
SplunkTrust
SplunkTrust

For similar circumstances, I use eval. I don't have an exact match to your needs, but you could try first to pull out the field you need with a rex (I don't have any ... is that an apache log? ... handy, so I'm sure someone else or other searching can turn up a better rex because this one is terrible. You could probably use the Field Extractor to get the field out, too.)

rex  "- - (?<time_taken>\d{1,5}) "

Then use that field, which IIRC you should be able to just do a

eval end_time=_time+time_taken

jlhamlet
Path Finder

Hi Rich,

Thank you, i did not expect it to be that simple 🙂

After your solution "eval end_time=_time+time_taken" i got results in Epoch time.
So i had to convert it using "convert" , "timeformat" and "ctime" to convert it back to normal.

Thank you 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...