The following series of eval commands calculate the Stardate in the field "star_date".
First it determines the year, the length of the year, and the proportion of the year that has gone by. Years are relative to year 2323.
< your search >
| eval year=strftime(_time, "%Y")
| eval leap = if((year % 4 == 0) and ((year % 100 != 0) or (year % 400 == 0)), "1", "0")
| eval length = if(leap=="1", 31622400, 31526000)
| eval time = _time - (60*date_zone)
| eval year_date = relative_time(time,"@y")
| eval star_time =((time - year_date) * 1000 / length )
| eval star_year = year - 2323
| eval star_date = star_year.star_time
There's an interesting bit of detail regarding timezones in that the snap-to-times in Splunk are local to your local timezone, meaning @y (the beginning of the year) is different for users in California and Russia. To compensate for that, we modify the 'time' value with the date_zone field.
This example is good for introducing eval, strftime, if(), and relative_time().
... View more
