Splunk Search

When converting time to epoch, why am I getting weird results?

Path Finder

Hi All,

I am experiencing somewhat weird results when converting time to epoch in our Splunk environment. I tried to convert 1:00 AM and 8:00 AM to epoch time, and for some reason, the epoch time of 1:00 AM is greater than the epoch time of 8:00 AM. What could be the reason behind this?

See below for sample code and results:

startLoad=strptime("1:00 AM", "%I:%M %p"),
endLoad=strptime("8:00 AM", "%I:%M %p")

alt text alt text

Thanks in advance!

1 Solution

Ultra Champion

1540108800 = 8 AM on Sunday,
1540170000 = 1 AM on Monday.

I guess when not specifying the date, Splunk maps the time to the previous day, if the respective timestamp hasn't passed yet (or would be 'too far into the future'? So if you evaluate it on Monday early morning, before 8 AM, it will map 8 AM to Sunday?

I've just tested this. When I do an | eval endLoad=strptime("3:00 PM", "%I:%M %p") (it is Tuesday 23rd UTC 7:40 AM when posting this) it indeed evaluates to 3 PM on Monday 22nd.

View solution in original post

Ultra Champion

1540108800 = 8 AM on Sunday,
1540170000 = 1 AM on Monday.

I guess when not specifying the date, Splunk maps the time to the previous day, if the respective timestamp hasn't passed yet (or would be 'too far into the future'? So if you evaluate it on Monday early morning, before 8 AM, it will map 8 AM to Sunday?

I've just tested this. When I do an | eval endLoad=strptime("3:00 PM", "%I:%M %p") (it is Tuesday 23rd UTC 7:40 AM when posting this) it indeed evaluates to 3 PM on Monday 22nd.

View solution in original post

Champion

All looks good on my splunk splunk 7.0.3.. pls run this and post your results..

| makeresults 
| eval startLoad=strptime("1:00 AM", "%I:%M %p") 
| eval endLoad=strptime("8:00 AM", "%I:%M %p") 
| eval startloadback=strftime(startLoad, "%I:%M %p")
| eval endloadback=strftime(endLoad, "%I:%M %p")
| table startLoad endLoad startloadback endloadback

alt text

0 Karma

Splunk Employee
Splunk Employee

Is it possible they are referring different date ? Have you tried to add the date together with the time ?

0 Karma

Influencer

Hi,

I am getting the correct results. Can you please paste your complete query here.

0 Karma

Path Finder

Hi @Vijeta,

I just used the |makeresults because I just need to create those 2 fields with the said value. So my code is like this,

| makeresults
| eval startLoad=strptime("1:00 AM", "%I:%M %p"),
endLoad=strptime("8:00 AM", "%I:%M %p")

May I know the results you get?

Thanks.

0 Karma

Super Champion

@jvmerilla,
Results is -

endLoad=1540175400.000000
startLoad=1540150200.000000
0 Karma