Refine your search:

For example I've got some values coming in such as, how can i convert the time value to a field within splunk converted to seconds?

CAA:1267224368:72853:INFO: LegID = A3974: Calling = 14082323445, called = 3666, dial peer = 1
CAA:1267224368:72854:INFO: LegID = A3974: Leg State = LEG_INCCONNECTED
CAA:1267224370:72855:INFO: Internal Document read requested, URL =

asked 23 Apr '10, 00:22

Chris%20R.'s gravatar image

Chris R.
1.1k10332
accept rate: 36%


2 Answers:

To convert the epoch seconds value you can display an additional field with the timestamp(in the format you wish. Since your data is already indexed with the timestring in epoch seconds the easiest way to convert it would be to use the IFX field picker. This will enable you to capture custom fields, Then we can run a search string to convert that value to a time format

  • run a search in your ui to get results with the epoch value events and choose "extract fields"
  • use the IFX field extractor shows results, highlight just the timestamp (just the seconds value )
  • Test it and check your results show, when satisfied save as a custom field i'll call it "epoch_sec" for the example below
  • use that custom field in a search string and pass it to the "ctime" method and use convert on the search string. Per this example

    source="/path_to_epoch_events" | convert timeformat="%m/%d/%Y %H:%M:%S" ctime(epoch_sec) as timestr 
    
link

answered 23 Apr '10, 00:24

Chris%20R.'s gravatar image

Chris R.
1.1k10332
accept rate: 36%

1

You can of course use other methods to get the field (rex command, manually crafted field extraction), but this gives a complete series of steps.

(23 Apr '10, 08:06) jrodman ♦

There appears to be a bug in 4.1.6 that ctime will NOT work. This seems to be resolved in 4.2.2.

link

answered 22 Jul '11, 13:10

lokispundit's gravatar image

lokispundit
11
accept rate: 0%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×100
×53

Asked: 23 Apr '10, 00:22

Seen: 2,937 times

Last updated: 22 Jul '11, 13:10

Copyright © 2005-2012 Splunk Inc. All rights reserved.