Splunk Search

Unix Time Math for a Field

kholleran
Communicator

Hello,

I currently am doing a search that uses a unix time as a field. What I want to do, is do something like this at search time:

source="mysource" my_unix_time < (unix_time(now)-6 Months)

Effectively, I want to say, keep only entries where this field's date time is greater than six months (not the actual time the data was logged, this specific field). I am converting the unix time to something readable with convert timeformat="%Y-%m-%d %H:%M:%S" ctime(my_unix_time) so I am not sure if date manipulation is easier after this or before.

Thanks for any help.

Kevin

Tags (1)
0 Karma
1 Solution

Lowell
Super Champion

If you are running 4.1 you can use the relative_time() eval function, so your expression could be written:

 source="mysource" | where my_unix_time < relative_time(time(), "-6mon") | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(my_unix_time)

Note that time() is the wall-clock time, where as the now() eval function is based on the time when the search was started (or was scheduled to start).

Docs: Functions for eval and where

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

I'm assuming my_unix_time is not equal to the event timestamp?

0 Karma

Lowell
Super Champion

If you are running 4.1 you can use the relative_time() eval function, so your expression could be written:

 source="mysource" | where my_unix_time < relative_time(time(), "-6mon") | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(my_unix_time)

Note that time() is the wall-clock time, where as the now() eval function is based on the time when the search was started (or was scheduled to start).

Docs: Functions for eval and where

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...