Splunk Search

Relative_time() and convert() Function

vasanthmss
Motivator

Hi Splunkers,

when i'm running first Search returns getting zero value where as second Search giving correct value. Explain me how its working,

Search 1:

|stats count | eval next_time=relative_time(now(),"-45y")

Search 2:

|stats count | eval next_time=relative_time(now(),"-45y")| convert ctime(*_time)
V
1 Solution

vasanthmss
Motivator

fdi01
Motivator

so see your command eval = next_time relative_time (now (), "- 45y") will provide no results that eventually you converted,
because if you run these commands get the same result
|stats count | eval next_time=relative_time(now(),"-45y")| convert ctime(_time)

or |stats count | convert ctime(
_time)

try the following different commands to understand the operation.
|stats count | convert ctime(count)
or
|stats count | convert timeformat="%H:%M:%S" ctime(count)
or
|stats count | eval next_time=count| convert ctime(_time) or |stats count | convert ctime(_time) next_time

0 Karma

kml_uvce
Builder

In first search its zero as its epoch time (start time) and when you are converting this epoch time in second search then its giving in date format
http://en.wikipedia.org/wiki/Unix_time

kamal singh bisht
0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...