Splunk Search

How do I create a time field?

danielbb
Motivator

I have the EVENT_TIMESTAMP_UTC field with the values of -

 

2020-11-19 13:50:08.393085
2020-11-19 13:50:08.3517
2020-11-19 13:50:08.306023
2020-11-19 13:50:08.238995
2020-11-19 13:50:08.16885

 

I would like to create a new time field and treat the data as in the UTC time-zone. 

Labels (1)
Tags (1)

to4kawa
Ultra Champion

hi @inventsekar 
I thought the log was JSON, so I started by making the multi-value to single.
We can use rex with max_match and do it all at once with mvmap.

If it was a single value, rex and eval are enough.

to4kawa
Ultra Champion
| makeresults
| eval EVENT_TIMESTAMP_UTC=split("2020-11-19 13:50:08.393085,2020-11-19 13:50:08.3517,2020-11-19 13:50:08.306023,2020-11-19 13:50:08.238995,2020-11-19 13:50:08.16885",",")
| rename COMMENT as "the logic" 
| mvexpand EVENT_TIMESTAMP_UTC
| rex field=EVENT_TIMESTAMP_UTC "(?<data>\d[\w\-: ]+)\.(?<msecond>\d+)"
| eval msecond=printf("%06d",msecond)
| eval EVENT_TIMESTAMP_UTC=strptime(data.msecond,"%F %T%6Q")

inventsekar
SplunkTrust
SplunkTrust

Great query @to4kawa ... i need to learn lot of stuff from your search queries!

but could you pls explain us the context here.. i got confused with this request... the question says "I have the EVENT_TIMESTAMP_UTC field"... 
then  why "treat the data as in the UTC time-zone" ?!?!

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...