When converting time to epoch, why am I getting weird results?

[jvmerilla]

Hi All,

I am experiencing somewhat weird results when converting time to epoch in our Splunk environment. I tried to convert 1:00 AM and 8:00 AM to epoch time, and for some reason, the epoch time of 1:00 AM is greater than the epoch time of 8:00 AM. What could be the reason behind this?

See below for sample code and results:

startLoad=strptime("1:00 AM", "%I:%M %p"),
endLoad=strptime("8:00 AM", "%I:%M %p")

Thanks in advance!

[FrankVl · Accepted solution]

1540108800 = 8 AM on Sunday,
1540170000 = 1 AM on Monday.

I guess when not specifying the date, Splunk maps the time to the previous day, if the respective timestamp hasn't passed yet (or would be 'too far into the future'? So if you evaluate it on Monday early morning, before 8 AM, it will map 8 AM to Sunday?

I've just tested this. When I do an | eval endLoad=strptime("3:00 PM", "%I:%M %p") (it is Tuesday 23rd UTC 7:40 AM when posting this) it indeed evaluates to 3 PM on Monday 22nd.

[inventsekar]

All looks good on my splunk splunk 7.0.3.. pls run this and post your results..

| makeresults 
| eval startLoad=strptime("1:00 AM", "%I:%M %p") 
| eval endLoad=strptime("8:00 AM", "%I:%M %p") 
| eval startloadback=strftime(startLoad, "%I:%M %p")
| eval endloadback=strftime(endLoad, "%I:%M %p")
| table startLoad endLoad startloadback endloadback

[tlam_splunk]

Is it possible they are referring different date ? Have you tried to add the date together with the time ?

[Vijeta]

Hi,

I am getting the correct results. Can you please paste your complete query here.

[jvmerilla]

Hi @Vijeta,

I just used the |makeresults because I just need to create those 2 fields with the said value. So my code is like this,

| makeresults
| eval startLoad=strptime("1:00 AM", "%I:%M %p"),
endLoad=strptime("8:00 AM", "%I:%M %p")

May I know the results you get?

Thanks.

[493669]

@jvmerilla,
Results is -

endLoad=1540175400.000000
startLoad=1540150200.000000