Splunk Search

How do I create a time field?

danielbb
Motivator

I have the EVENT_TIMESTAMP_UTC field with the values of -

 

2020-11-19 13:50:08.393085
2020-11-19 13:50:08.3517
2020-11-19 13:50:08.306023
2020-11-19 13:50:08.238995
2020-11-19 13:50:08.16885

 

I would like to create a new time field and treat the data as in the UTC time-zone. 

Labels (1)
Tags (1)

to4kawa
Ultra Champion

hi @inventsekar 
I thought the log was JSON, so I started by making the multi-value to single.
We can use rex with max_match and do it all at once with mvmap.

If it was a single value, rex and eval are enough.

to4kawa
Ultra Champion
| makeresults
| eval EVENT_TIMESTAMP_UTC=split("2020-11-19 13:50:08.393085,2020-11-19 13:50:08.3517,2020-11-19 13:50:08.306023,2020-11-19 13:50:08.238995,2020-11-19 13:50:08.16885",",")
| rename COMMENT as "the logic" 
| mvexpand EVENT_TIMESTAMP_UTC
| rex field=EVENT_TIMESTAMP_UTC "(?<data>\d[\w\-: ]+)\.(?<msecond>\d+)"
| eval msecond=printf("%06d",msecond)
| eval EVENT_TIMESTAMP_UTC=strptime(data.msecond,"%F %T%6Q")

inventsekar
SplunkTrust
SplunkTrust

Great query @to4kawa ... i need to learn lot of stuff from your search queries!

but could you pls explain us the context here.. i got confused with this request... the question says "I have the EVENT_TIMESTAMP_UTC field"... 
then  why "treat the data as in the UTC time-zone" ?!?!

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...