Splunk Enterprise

Convert just the Time from _time to epoch

tmontney
Builder

I've seen a lot of questions asking to get just the date from date/time stamp and convert to epoch. I want to do it for time.

eval Time=strptime(strftime(_time, "%H:%M:%S"), "%H:%M:%S")

I've tried this, but the date still seems to go with it. Epoch returns date with it. For instance, it returns 1491949028. I'm expecting a epoch value between 0 and 86400, where the date is 1/1/1970. My point is I want to determine if the date is between the hours of 8 AM and 5 PM.

0 Karma

DMohn
Motivator

The epoch will always contain date and time, as this is the definition of the epoch format. If you just want to evaluate the hours, you can use the following search string:

<your base search> | eval hours=strftime(_time,"%H") | where hours > 7 AND hours < 18
0 Karma

masonmorales
Influencer

Wouldn't the date_hour field work for this?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...