(index=unix) (sourcetype="web") | eval Time.atFirewall=DateOutbound-DateInbound | eval Time.atDataCentre=strptime(index_time,"yyyy-MM-dd'T'HH:mm:ss.SSSZ") | eval Time.SendGrid=Time.atDataCentre-DateInbound | table index_time DateInbound DateOutbound Time.atFirewall Time.atDataCentre
I get this in search:
Error in 'eval' command: Typechecking failed. '-' only takes numbers.
DateOutbound & DateInbound are Epoch Time fields, and I wanted to convert index time to Epoch to do the maths. It seems that Time.atDataCentre is not assigned an Epoch time value, it's not a number, hence the Error message from Splunk. I am following the documentation on strptime, so puzzled.
Anyone ever convert long date / Zulu date to Epoch time?
... View more