Splunk Search

Time Conversion

mbasharat
Builder

Hi,

I have time format as:
2019-10-08 15:24:40.132 UTC

I used eval to strip it to:
2019-10-08 15:24:40

I need to calculate Age. My eval is below but it is not working. Can someone assist pls?

| eval age=ceiling((now()-strptime(Event_Created_Time_Date,"%F %H:%M:%S"))/86400)

| eval Event_Age=case(
age<1,"1_Less than 1 Days",
age>=30,"6_Older than 30 Days",
age>=20,"5_Older than 20 Days",
age>=10,"4_Older than 10 Days",
age>=5,"3_Older than 5 Days",
age>=2,"2_Older than 2 Days",
0==0,"7_No Age Data")

Labels (1)
Tags (1)
0 Karma
1 Solution

manjunathmeti
Champion

hi @mbasharat, For timezone (UTC) you can set variable "%Z".

Try this:

| makeresults 
| eval Event_Created_Time_Date="2019-10-08 15:24:40.132 UTC" 
| eval age=ceiling((now() - strptime(Event_Created_Time_Date, "%Y-%m-%d %H:%M:%S.%3N %Z"))/86400) 
| eval Event_Age=case(
    age<1,"1_Less than 1 Days",
    age>=30,"6_Older than 30 Days",
    age>=20,"5_Older than 20 Days",
    age>=10,"4_Older than 10 Days",
    age>=5,"3_Older than 5 Days",
    age>=2,"2_Older than 2 Days",
    0==0,"7_No Age Data")

View solution in original post

0 Karma

manjunathmeti
Champion

hi @mbasharat, For timezone (UTC) you can set variable "%Z".

Try this:

| makeresults 
| eval Event_Created_Time_Date="2019-10-08 15:24:40.132 UTC" 
| eval age=ceiling((now() - strptime(Event_Created_Time_Date, "%Y-%m-%d %H:%M:%S.%3N %Z"))/86400) 
| eval Event_Age=case(
    age<1,"1_Less than 1 Days",
    age>=30,"6_Older than 30 Days",
    age>=20,"5_Older than 20 Days",
    age>=10,"4_Older than 10 Days",
    age>=5,"3_Older than 5 Days",
    age>=2,"2_Older than 2 Days",
    0==0,"7_No Age Data")
0 Karma

mbasharat
Builder

THANK YOU!!!

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...