Splunk Enterprise

Compare usual time to Epoch time

luckyman80
Path Finder

Hi Experts! ,

                      Wondered if there was a way of doing this. I have a need to compare a timestamp of a log to an EPOCH time also on the same log line and show the Diff

Example

2021-10-05 04:49:10.138 [pool-1-thread-1] INFO order - [Pool]Book={inst=example,1=[],2=[feed-|time=1633427347600000000}

Manually looking the difference is 

2021-10-05 04:49:10.138 -(Standard time)

2021-10-05 04:49:07.600 -(EPOCH time)

Difference 2.54 seconds

Thanks in advance

Labels (1)
Tags (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

OK extract epoch like this

| rex "time=(?<epoch>\d*)"

View solution in original post

0 Karma

somesoni2
Revered Legend

Try this

Your base search| eva diff=_time-time | table diff
0 Karma

luckyman80
Path Finder
Spoiler
i did try that .. now I get 
_time as 2021-10-07 12:30:03.839

and diff as -1633624103220375800.000

0 Karma

somesoni2
Revered Legend

Try this

Your base search | eval diff=abs(_time-(time/1000000000))

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Is your "standard" time already extracted as _time?

Your EPOCH time looks like it might be in nano-seconds, so try

| eval diff=_time-(epoch/1000000000)
0 Karma

luckyman80
Path Finder

Hi! Thanks for the quick response!  I haven't Extracted time yet (not sure how to do that) also how do I display it after ? sorry for all the questions 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You may find it has already been extracted for you when the events were indexed. What fields do you have extracted?

0 Karma

luckyman80
Path Finder

Apols if im being stupid . I tried 

| eval diff=_time-(epoch/1000000000)|table diff

but dont see anything 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What do you get if you just do 

<<your search>>
| table _time epoch
0 Karma

luckyman80
Path Finder

_time looks like this 

2021-10-07 08:28:04.211

epoch column  is blank 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

OK extract epoch like this

| rex "time=(?<epoch>\d*)"
0 Karma

luckyman80
Path Finder

thank you ! worked great 

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...