host=*****| eval Time="17:00:00"|eval Time2="13:00:00" |eval Time=strptime(Time,"%H:%M:%S") |eval Time2=strptime(Time2,"%H:%M:%S") | table Time Time2
is giving the epoch time as
Time :1503327600.000000
Time2 :1503399600.000000
when I do a comparison of Time>Time2 is returning wrong result since the epoch is Time2 is greater.
Please help.
try using |convert dur2sec(Time) as Time timeformat="%H:%M:%S"
and the same for Time2 instead of strptime.
https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchReference/Convert
try using |convert dur2sec(Time) as Time timeformat="%H:%M:%S"
and the same for Time2 instead of strptime.
https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchReference/Convert
thanks this worked