Splunk Search

Time Conversion

mbasharat
Builder

Hi,

I have time format as:
2019-10-08 15:24:40.132 UTC

I used eval to strip it to:
2019-10-08 15:24:40

I need to calculate Age. My eval is below but it is not working. Can someone assist pls?

| eval age=ceiling((now()-strptime(Event_Created_Time_Date,"%F %H:%M:%S"))/86400)

| eval Event_Age=case(
age<1,"1_Less than 1 Days",
age>=30,"6_Older than 30 Days",
age>=20,"5_Older than 20 Days",
age>=10,"4_Older than 10 Days",
age>=5,"3_Older than 5 Days",
age>=2,"2_Older than 2 Days",
0==0,"7_No Age Data")

Labels (1)
Tags (1)
0 Karma
1 Solution

manjunathmeti
Champion

hi @mbasharat, For timezone (UTC) you can set variable "%Z".

Try this:

| makeresults 
| eval Event_Created_Time_Date="2019-10-08 15:24:40.132 UTC" 
| eval age=ceiling((now() - strptime(Event_Created_Time_Date, "%Y-%m-%d %H:%M:%S.%3N %Z"))/86400) 
| eval Event_Age=case(
    age<1,"1_Less than 1 Days",
    age>=30,"6_Older than 30 Days",
    age>=20,"5_Older than 20 Days",
    age>=10,"4_Older than 10 Days",
    age>=5,"3_Older than 5 Days",
    age>=2,"2_Older than 2 Days",
    0==0,"7_No Age Data")

View solution in original post

0 Karma

manjunathmeti
Champion

hi @mbasharat, For timezone (UTC) you can set variable "%Z".

Try this:

| makeresults 
| eval Event_Created_Time_Date="2019-10-08 15:24:40.132 UTC" 
| eval age=ceiling((now() - strptime(Event_Created_Time_Date, "%Y-%m-%d %H:%M:%S.%3N %Z"))/86400) 
| eval Event_Age=case(
    age<1,"1_Less than 1 Days",
    age>=30,"6_Older than 30 Days",
    age>=20,"5_Older than 20 Days",
    age>=10,"4_Older than 10 Days",
    age>=5,"3_Older than 5 Days",
    age>=2,"2_Older than 2 Days",
    0==0,"7_No Age Data")
0 Karma

mbasharat
Builder

THANK YOU!!!

0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...