Hello,
I would like to convert all possible values set in a time input to epoch time format. This means that it should manage values like:
-d@d
@w
now
i have found similar threads like this which recommend the relative_time()
function, but it doesn't manage all cases. I also found a thread about filtering all values in a time input within a search:
| where if("$time_input.earliest$"!="0" AND "$time_input.earliest$"!="",_time>=if(replace("$time_input.earliest$","\d","")!="",relative_time(now(),if("$time_input.earliest$"="now","-0m","$time_input.earliest$")),"$time_input.earliest$"),0=0) AND if("$time_input.latest$"!="0" AND "$time_input.latest$"!="",_time<if(replace("$time_input.latest$","\d","")!="",relative_time(now(),if("$time_input.latest$"="now","-0m","$time_input.latest$")),"$time_input.latest$"),0=0)
but I cannot figure out how to convert this for use in an eval
Could somebody help me out?
Thank you and best regards,
Andrew
Is the timepicker being used to set the parameters of the search? If so, you can do this:
| addinfo
| eval early_time=info_min_time, late_time=info_max_time
And if you don't like having the extra info* fields, you can follow that with:
| fields - info_max_time info_min_time info_search_time info_sid
Is the timepicker being used to set the parameters of the search? If so, you can do this:
| addinfo
| eval early_time=info_min_time, late_time=info_max_time
And if you don't like having the extra info* fields, you can follow that with:
| fields - info_max_time info_min_time info_search_time info_sid
@elliotproebstel this is perfect! No conversions required!
Great! I converted it to an answer so you can accept it to help others find it in the future. 🙂