Splunk Search

Unix Time Math for a Field

kholleran
Communicator

Hello,

I currently am doing a search that uses a unix time as a field. What I want to do, is do something like this at search time:

source="mysource" my_unix_time < (unix_time(now)-6 Months)

Effectively, I want to say, keep only entries where this field's date time is greater than six months (not the actual time the data was logged, this specific field). I am converting the unix time to something readable with convert timeformat="%Y-%m-%d %H:%M:%S" ctime(my_unix_time) so I am not sure if date manipulation is easier after this or before.

Thanks for any help.

Kevin

Tags (1)
0 Karma
1 Solution

Lowell
Super Champion

If you are running 4.1 you can use the relative_time() eval function, so your expression could be written:

 source="mysource" | where my_unix_time < relative_time(time(), "-6mon") | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(my_unix_time)

Note that time() is the wall-clock time, where as the now() eval function is based on the time when the search was started (or was scheduled to start).

Docs: Functions for eval and where

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

I'm assuming my_unix_time is not equal to the event timestamp?

0 Karma

Lowell
Super Champion

If you are running 4.1 you can use the relative_time() eval function, so your expression could be written:

 source="mysource" | where my_unix_time < relative_time(time(), "-6mon") | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(my_unix_time)

Note that time() is the wall-clock time, where as the now() eval function is based on the time when the search was started (or was scheduled to start).

Docs: Functions for eval and where

Get Updates on the Splunk Community!

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...