Splunk Search

Unable to eval correct epoch time

smuderasi
Explorer
host=*****|  eval Time="17:00:00"|eval Time2="13:00:00" |eval Time=strptime(Time,"%H:%M:%S")  |eval Time2=strptime(Time2,"%H:%M:%S")  | table Time Time2

is giving the epoch time as
Time :1503327600.000000

Time2 :1503399600.000000

when I do a comparison of Time>Time2 is returning wrong result since the epoch is Time2 is greater.
Please help.

0 Karma
1 Solution

cmerriman
Super Champion

try using |convert dur2sec(Time) as Time timeformat="%H:%M:%S" and the same for Time2 instead of strptime.
https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchReference/Convert

View solution in original post

cmerriman
Super Champion

try using |convert dur2sec(Time) as Time timeformat="%H:%M:%S" and the same for Time2 instead of strptime.
https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchReference/Convert

smuderasi
Explorer

thanks this worked

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...