If the values in the timeStr field are hours and minutes, such as 11:59, the following example returns the time as a timestamp:

With the strptime function, you must specify the time format of the string so that the function can convert the string time into the correct UNIX time. If you attempt to use the strptime function on the _time field, no action is performed on the values in the field. In Splunk Web, the _time field appears in a human readable format in the UI but is stored in UNIX time. The strptime function takes any date from Januor later, and calculates the UNIX time, in seconds, from Januto the date you provide. The timestamps must include a day.įor example, if the string is 17:19:01, the format must be %Y-%m-%d %H:%M:%S. The strptime function doesn't work with timestamps that consist of only a month and year. You use date and time variables to specify the format that matches string. Takes a human readable time, represented by a string, and parses the time into a UNIX timestamp using the format you specify. To return the date and time with subseconds and the time designator (the letter T) that precedes the time components of the format, use the %Y-%m-%dT%H:%M:%S.%Q variables. The results are show the value 34 for week. The variables must be in quotations marks.įor example, to return the week of the year that an event occurred in, use the %V variable. To convert the UNIX time to some other format, you use the strftime function with the date and time format variables. The _time field is stored in UNIX time, even though it displays in a human readable format.

The following example creates a single result using the from command. If the _time field value is 11:48:23, the value returned in the hour_min field is 11:48. | eval hour_min=strftime(_time, '%H:%M') The following example returns the hour and minute from the _time field. In these results the _time value is the date and time when the search was run.įor a complete list and descriptions of the format options you can use, see Using time variables in the SPL2 Search Manual. The following search uses the pow function to convert from nanoseconds to seconds: To convert from nanoseconds to seconds, divide the number by 10^9.To convert from microseconds to seconds, divide the number by 10^6.To convert from milliseconds to seconds, divide the number by 1000 or 10^3.You can use the pow function to convert the number. If the time is in milliseconds, microseconds, or nanoseconds you must convert the time into seconds.

Use the first 10 digits of a UNIX time to use the time in seconds. This function takes a UNIX time value and renders the time as a string using the format specified. | where _time>relative_time(now(), AND _time,) | eval n=relative_time(now(), following example specifies an earliest time of 2 hours ago snapped to the hour and a latest time of 1 hour ago snapped to the hour: This function takes a UNIX time and a relative time specifier and returns the UNIX time value of the specifier applied to the time. | timechart count() by _time relative_time(,) | where (eventHour=curHour and eventMin > curMin - 30) or The event timestamp, in the _time field, is used to calculate the event hour (eventHour) and event minute (eventMin). You use the now() function to calculate the current hour (curHour) and current minute (curMin). If you are looking for events that occurred within the last 30 minutes you need to calculate the event hour, event minute, the current hour, and the current minute. | eval n=relative_time(now(), Extended example The following example determines the UNIX time value of the start of yesterday, based on the value of now(). You can use this function with the eval and where commands, in the WHERE clause of the from command, and as part of evaluation expressions with other commands.

If you want to return the UNIX time when each result is returned, use the time() function instead. When used in a search, this function returns the UNIX time when the search is run.

The time returned by the now() function is represented in UNIX time, or in seconds since Epoch time. The now() function is often used with other data and time functions. This function takes no arguments and returns the time that the search was started. The following list contains the functions that you can use to calculate dates and time.įor information about using string and numeric fields in functions, and nesting functions, see Overview of SPL2 eval functions.

Splunk eval count