Splunk Search

Unix Time Math for a Field

kholleran
Communicator

Hello,

I currently am doing a search that uses a unix time as a field. What I want to do, is do something like this at search time:

source="mysource" my_unix_time < (unix_time(now)-6 Months)

Effectively, I want to say, keep only entries where this field's date time is greater than six months (not the actual time the data was logged, this specific field). I am converting the unix time to something readable with convert timeformat="%Y-%m-%d %H:%M:%S" ctime(my_unix_time) so I am not sure if date manipulation is easier after this or before.

Thanks for any help.

Kevin

Tags (1)
0 Karma
1 Solution

Lowell
Super Champion

If you are running 4.1 you can use the relative_time() eval function, so your expression could be written:

 source="mysource" | where my_unix_time < relative_time(time(), "-6mon") | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(my_unix_time)

Note that time() is the wall-clock time, where as the now() eval function is based on the time when the search was started (or was scheduled to start).

Docs: Functions for eval and where

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

I'm assuming my_unix_time is not equal to the event timestamp?

0 Karma

Lowell
Super Champion

If you are running 4.1 you can use the relative_time() eval function, so your expression could be written:

 source="mysource" | where my_unix_time < relative_time(time(), "-6mon") | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(my_unix_time)

Note that time() is the wall-clock time, where as the now() eval function is based on the time when the search was started (or was scheduled to start).

Docs: Functions for eval and where

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...