About timm7474

timm7474 · ‎06-14-2021

I just ran a test and did this to see how formatting would be for a day or more time difference. | eval time_diff=(1623704985-new_mdctime). (the # is June 14, 2021 9:09:45 PM) against this date: 2021-06-11T21:48:28.254Z Which has a strptime of1623462508.254000 I get a difference of: 242476.746000 Any idea how to get it formatted properly so it shows hours, minutes, seconds and milliseconds? Thanks!

timm7474 · ‎06-14-2021

0.114000 0.011000 and time_diff_final looks like this for the above values. And you can see the 19 added when I add hour %H. 19:00:00.114 19:00:00.011

timm7474 · ‎06-14-2021

Sure, here is that part of the SPL. | eval new_attimestamp=strptime('@timestamp',"%Y-%m-%dT%H:%M:%S.%3Q") | eval new_mdctime=strptime('mdc.time',"%Y-%m-%dT%H:%M:%S.%3Q") | eval time_diff=(new_attimestamp-new_mdctime) | eval time_diff_final=strftime(time_diff,"%H:%M:%S.%3")

timm7474 · ‎06-14-2021

Hi, I have a field called time_diff that I've eval'd from two other fields to calculate the difference in time between those fields. The calculation is working fine and when I strftime the time_diff back to human readable, I'm using eval time_diff_final=strftime(time_diff, "%H:%M:%S.%3Q") When I display the result of time_diff I see 0.13400 However when I look at the result of time_diff_final I see this. 19:00:00.134 The milliseconds is the correct calculation, but for some reason instead of putting a zero in the %H field I'm getting 19 for every single result. Any ideas? Thanks!

timm7474 · ‎05-18-2021

This worked in the XML. Thank you!

timm7474 · ‎05-17-2021

Thanks for the quick reply, still no luck. To add a bit more context, I am using click.name2 to grab column names to use in my search. But when click.name2 is equal to the far right column name, I want to change the token to * since that name is a label for that column and not an actual searchable column name like the rest of the columns (if that makes sense). I'm also using an eval in the search to get the column names and I tried adding this eval to the bottom under the search before the </drilldown> with still no luck.

timm7474 · ‎05-17-2021

I'm trying to check the value of a token and if it is equal to "X" change it to an * but if it is equal to anything else, leave the token alone. I'm trying something like this but not sure it is possible. <drilldown> <eval token='my_token'> if("X", "*", $my_token$)</eval> <link target="_blank">search?q= my search...my_field=$my_token$.....blah blah blah... </link> </drilldown> Thanks.

Posts	7
Solutions	1
Karma Given	2
Karma Received	0
Member Since	‎01-08-2021

Online Status	Offline
Date Last Visited	‎03-23-2022 02:28 PM

Strftime and adding leading zeros to time differen...

Token eval Question

Re: Strftime and adding leading zeros to time diff...

Re: Strftime and adding leading zeros to time diff...

Re: Strftime and adding leading zeros to time diff...

Strftime and adding leading zeros to time differen...

Re: Token eval Question

Re: Token eval Question

Token eval Question