Splunk Search

Is there a conversion function for time modifiers?

johnraftery
Communicator

Hi, I'm using a time picker which gives you a start and end token as time modifiers (eg "-2d@d - now" for the last two days). See http://docs.splunk.com/Documentation/Splunk/6.3.3/Search/Specifytimemodifiersinyoursearch

Is there a function to convert the time modifier into an absolute time (ie 1456312200 - 1456482900)? I know I can put the time modifiers into the earliest and latest tags of my query, but I'm actually querying a lookup table so there is no _time field to base it on; I need to restrict the time in the query itself.

Thanks,
John

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try the relative_time() function. For example,

... | eval absTime = relative_time(now(), $start$) | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try the relative_time() function. For example,

... | eval absTime = relative_time(now(), $start$) | ...
---
If this reply helps you, Karma would be appreciated.

johnraftery
Communicator

That's the one, thanks!

0 Karma

javiergn
Super Champion

Hi,

Sorry I'm not too sure what you are referring to.
Please take a look at the relative_time() function and let me know if that's what you are looking:

http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Commonevalfunctions#Date_and_Time_...

johnraftery
Communicator

That's the one, thanks!

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...