Splunk Search

JSON log event with two epoch timestamps

skelly99
Explorer

Hi - I have a JSON formated log file which contains two EPOCH millisecond formatted timestamps

One timestamp relates to the actual time of the log event.

The second timestamp event is the time that the NodeJS process received the request.
Both timestamps are logged as part of the same log event - the log event only being created at response time.

I am extracting the log event timestamp successfully using props.conf settings TIME_PREFIX, & TIME_FORMAT (%s%3N).
This sets the _time value correctly with milliseconds being displayed.

I want to use the second timestamp at search time to calculate the difference between the two timed events in the log.
I am running into issues in converting the second timestamp as it appears the strftime function does not support milliseconds.

  Using  eval ReqTime=strftime(dtime, "%d-%m-%Y %H:%M:%S.%3N") gives a date value of 31-12-9999 23:59:59.999
  Using  eval ReqTime=strftime(dtime/1000, "%d-%m-%Y %H:%M:%S") gives the correct date/time but I lose milliseconds 

Welcome any suggestions on best way to convert the second epoch timestamp but maintaining milliseconds so that I can then calculate the difference between the two times.

Thanks

Tags (2)
0 Karma

woodcock
Esteemed Legend

Like this:

   ... | eval ReqTime=strftime(dtime/1000, "%d-%m-%Y %H:%M:%S.%6N")

You might have to adjust the 6 to something else (try 3).

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...