Splunk Search

Unix Time Math for a Field

kholleran
Communicator

Hello,

I currently am doing a search that uses a unix time as a field. What I want to do, is do something like this at search time:

source="mysource" my_unix_time < (unix_time(now)-6 Months)

Effectively, I want to say, keep only entries where this field's date time is greater than six months (not the actual time the data was logged, this specific field). I am converting the unix time to something readable with convert timeformat="%Y-%m-%d %H:%M:%S" ctime(my_unix_time) so I am not sure if date manipulation is easier after this or before.

Thanks for any help.

Kevin

Tags (1)
0 Karma
1 Solution

Lowell
Super Champion

If you are running 4.1 you can use the relative_time() eval function, so your expression could be written:

 source="mysource" | where my_unix_time < relative_time(time(), "-6mon") | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(my_unix_time)

Note that time() is the wall-clock time, where as the now() eval function is based on the time when the search was started (or was scheduled to start).

Docs: Functions for eval and where

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

I'm assuming my_unix_time is not equal to the event timestamp?

0 Karma

Lowell
Super Champion

If you are running 4.1 you can use the relative_time() eval function, so your expression could be written:

 source="mysource" | where my_unix_time < relative_time(time(), "-6mon") | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(my_unix_time)

Note that time() is the wall-clock time, where as the now() eval function is based on the time when the search was started (or was scheduled to start).

Docs: Functions for eval and where

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...