Splunk Search

Adding seconds to _time

ChhayaV
Communicator

hi,

I want to add some seconds in the current _time.
Is there any build in function for it?

e.g_time=23:03:39.022
after adding 4.90 seocnds it should be 23:03:43.936

Thanks

0 Karma

Ayn
Legend

_time is actually in epoch format, Splunk just converts the format automatically before showing it to you so that it's human readable. So, to add 4 seconds, just do eval _time=_time+4.

Note that this is purely a search-time operation - if you want to do this at index-time the problem is much more complex because functions for performing arithmetic etc are not available.

sowings
Splunk Employee
Splunk Employee

This works, and gives milliseconds:

convert timeformat="%Y/%m/%d %H:%M:%S.%3N" ctime(_time) AS timestr

What did you try that didn't work?

ChhayaV
Communicator

already tried

0 Karma

kristian_kolb
Ultra Champion

shouldn't the expected outcome be 23:03:39.846 ?

and for strftime/strptime, %3N, %6N are the variables for milli- and microseconds, respectively.

http://docs.splunk.com/Documentation/Splunk/5.0.5/SearchReference/Commontimeformatvariables

0 Karma

ChhayaV
Communicator

hi
input time: 23:03:43.936
after subtracting 4.09
expected output time: 23:03:39.022

but output time is 23:03:39

i gave %ms after %S but not working and when i export it to CSV time column is not proper it show ### in the column

0 Karma

sowings
Splunk Employee
Splunk Employee

Your time format output truncates to seconds. You'll need to add some placeholder in the format string for milli / microseconds.

0 Karma

Ayn
Legend

Explain more clearly. What do you mean by not being able to see milliseconds? What are you expecting to see, and what are you not seeing?

0 Karma

ChhayaV
Communicator

got it ..but i am not able to see milliseconds

index=tm_idx host="server" index=tm_idx host="server" "finished executing normally" | rex field=_raw "(?i)Process\s(\"|\"})(?\w+)" | rex field=_raw "elapsed\stime\s(?\w+.\w+)\sseconds" | eval time=_time-myduration| convert timeformat="%m/%d/%Y %H:%M:%S" ctime(time) as timestr |table _time timestr _raw myduration

this is my search

0 Karma

Ayn
Legend

Yup. Epoch is just seconds, so add how many seconds you want.

0 Karma

ChhayaV
Communicator

if it is 200 seconds then resulted output time should also have minutes modified

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...