Hello All, I am trying to find the difference between first time and last time in epoch time. Hi All, I am experiencing somewhat weird results when converting time to epoch in our Splunk environment. . I know that splunk reads the epoch time and converts it to human readable format under the _time field but I want to transform the raw events to have human readable format. About; Products. conf to have the data indexed with the time field converted for human readability. Date and time function syntax reference for various programming languages. Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type. Community is for Everyone! ️ Our incredible community is a vital part of Splunk’s customer. Is there a better java time variable to convert "0" in epoch into 0. bowesmana. 0. You will need a lookup table to interpret TIMEZONE as SPL does not provide such meta data. 11-08-2019 04:55 AM. Converting timestamp to date? MichaelCohen821. But what I struggle now is to convert the timeStamp -string to date format to get at the end the min (timeStamp) extracted in order to compute the difference between the event's _time and the min (timeStamp) by the id field. how to calculate duration between two events Splunk. 1484063893), string representation (e. One thing I forgot is _time actually is already in epoch but just displayed human readable in Splunk UI. COVID-19 Response SplunkBase Developers Documentation. You can specify the time format by timeforma t argument. conf. In this tutorial we are going to see about date and time format, how we can strip out a part of timestamp like yea. Subscribe to RSS Feed; Mark Topic as New; Mark Topic as Read; Float this Topic for Current User; Bookmark Topic;. Try this to verify that it extracts the value correctly: Look for a new field called 'uploadTime' and verify that it has the correct value. Convert timepicker token to epoch time for eval, regardless of timepicker combination. The first half of your SPL correctly converts an apiStartTime string into epoch form. If I'm not wrong, convert needs epoch time for ctime(). Splunk Data Stream Processor. So this answer looks at the new value of the timepicker whenever it changes, and figures out how to convert that value to epoch time. Once that works, then this should do the math to convert _time to milliseconds, add the uploadTime, and convert the total time. I've made a deep search and tried with convert, rename and eval functions but none of them are working for me (at least the way I'm using them). Use time modifiers to customize the time range of a search or change the format of the timestamps in the search results. 210" |. Communicator. Is there a way to use the props. If you want to get super fancy and convert to your local timezone you can do so by knowing your UTC offset. g. Subscribe to RSS Feed; Mark Topic as New; Mark Topic as Read; Float this Topic for Current User;. Since Splunk uses 32-bit epoch time, events after 2038 cannot be indexed. Hi, I'm looking for the answer for the question you posted, Do you find any answer for this?I think Splunk strptime () is converting the timezone. Description. I am looking to format my current time to epoch time (as we need to calculate some math function on time) Time format for incidentEndTimeStr looks like this: 4/11/16. Convert Date to Day of Week. Splunk Administration. Usage of Splunk commands : CONVERT is as follows: This command converts the field values to numerical values. If you want to do it in JS use something like var epoch = Math. Splunk, Splunk>, Turn Data Into Doing, Data-to-Everything, and D2E are. This search doesn't gives me a readable time but the time isn't correct as the date are all the same with the year being 9999. This timestamp, which is the time when the event occurred, is saved in UNIX time. Background. However, to extract a time from a field in the data you use the strptime () function, e. What setting should be placed in the props. Solved: I have following Splunk Query which is trying to format Epoch captured start and end time into human readable format but seems like splunk is SplunkBase Developers Documentation Browse Once in epoch you can let Splunk represent it in the relative local timezone of the viewer OR always in EPOCH easily using Eval's strptime OR the convert. Handling Time" "Avg. Community. Tags (1) Tags: splunk-enterprise. SplunkBase Developers Documentationturn them into epoch time before calculating the difference. One way to determine the time difference between two time zones is to take any date and treat is as a UTC time stamp and as an EST one and subtract their corresponding epoch times. Try this query. First you need to extract the time to upload as a field. Valheim Genshin Impact Minecraft Pokimane Halo Infinite Call of Duty: Warzone Path of Exile Hollow Knight: Silksong Escape from Tarkov Watch Dogs: Legion. 1) The question doesn't actually provide a. For example, if you create a field call time, convert user selection to epoch using <change> event/drilldown for time. Kindly help| fields Day DOW "Call Volume" "Avg. 04-07-2023 12:56 PM. Now, I've set the correct configuration in props. Converting UNIX timestamps into dates and times. 76" How i can convert this into the epoch time so that i can use the value to compare with other epoch value. Subscribe to RSS Feed; Mark Topic as New;. events:. fromtimestamp(1346114717972) Traceback (most recent call last): File "<stdin>", line 1, in <module> ValueError: timestamp out of range for platform time_tSplunkTrust. Options. I have a string from a complex JSON event providing an ISO 8601 date/time in UTC. 000000 Hours minutes seconds: 2607:25:17 COVID-19 Response SplunkBase Developers Documentation How do I convert a timestamp from any timezone to UTC in splunk? I have a field "DeviceTime" that can hold any time zone value. Splunk, Splunk>, Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or. Considering converting from epoch is one of the most common Splunk questions of all time, considering this page has 46k views, and considering that each and every answer is entirely incorrect (and the actual question itself is misleading) this page is desperately in need of removal. Here's myYou're a very nice gentlemen my friend! Issue is fixed I just have one more issue, when I try to rename my column header, it converts it again to an Epoch time, this is my new modified search with your solution: index=myIndex host=myHost confirmationNumber step_code="'BOOKING_DONE'" earliest=01/0. Splunk stores times in UTC and then renders them in the user's selected zone. Subscribe to RSS Feed; Mark Topic as New; Mark Topic as Read; Float this Topic for Current User; Bookmark Topic;. conf. Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction. When you then format them for display they'll be in your selected time zone. The time returned by the now () function is represented in UNIX time, or in seconds since Epoch time. and i want the difference epoch time to be in human readable . | tstats latest(_time) WHERE inde. – mklement0. Solved: How to convert the date and time in the below format to epoch time? 201303140216 yyyymmddHHMM here hour and minute is in 12 hours clock, so. <drilldo. seconds) which makes them easy to subtract. Since Splunk uses 32-bit epoch time, events after 2038 cannot be indexed. . If Splunk has read your timestamp (without the year) and parsed and indexed it correctly (you can compare the the timestamps in the events with the timestamp next to the blue down-arrow-thingy to the left of the event), then you can skip the first part and use the _time field, which is already in. When an event is processed by Splunk software, its timestamp is saved as the default field _time. 2/7/18 3:35:10. It is not showing any value in the human readable time column. . All you would need is | eval epoch1=_timeUsing Splunk: Splunk Search: How to convert time format 0:00:00:00 into a strin. This results in an epoch diff of "0" and if you strftime a "0" into days, it thinks it's 31 days, but it should be 0 days. For example 23:59:59. Use time modifiers to customize the time range of a search or change the format of the timestamps in the search results. If it is string time stamp i. For more information about working with dates and time, see. time-format. Handling Time" "Avg. Delta will compute the difference between nearby results using the value of a specific numeric field. Convert Millseconds to Epoch Time IRHM73. Hi I am setting a time token "WFDate_tok_display1" which has timestamp value from the user click. I am having a problem with my strptime in that it is not working. From the search line I can easily leverage the strftime command to get the. import datetime ts = datetime. You can convert between epoch and human readable time using other. Since your data is already indexed with the timestring in epoch seconds the easiest way to convert it would be to use the IFX field picker. The strptime function doesn't work with timestamps that consist of only a month and year. | eval epoch1 = _time. what i have so far which let converts it in a readable format. Read our Community Blog > Sitemap. I want to convert them to human readable format for some arbitrary timezone other than UTC. For more information about how the Splunk software determines a time zone and the tz database,. Builder 03-26-2020 09:26 AM. | eval first. I am looking to pass the a time range (-5m and +5m) relative to a row's _time value to another dashboard through the use of a drilldown but am having trouble getting this to work. Motivator 10-20-2015 01:41 AM. How do you expect the conversion to epoch to work then? Guessing? If you have sufficient data and a known starting point you could extrapolate AM/PM over a stream of events based on the rollover from 11 to 12, flipping the A/P every time -. getTime ()/1000) (or see stack overflow for dozens of variations) 01-05-2016 03:45 AM. 3 ) with automatic timestamp recognition parses the timestamp ( epoch in milliseconds), but there is no strptime equivalent for that so I cant specify custom timestamp extraction. Splunk Understanding Difference with epoch time and adding min. 3, many of the form inputs can be extended to set / unset / eval tokens based on other tokens or their new values. Don't use time formatting functions as they will take account of your time zone, but it's simple to do the. hence replying link again. If “x” was not an already listed field in our data, then I have now created a new field and have given that field the value of 2. 690" to a date in splunk. conf to convert it to human readable. I'm trying to change the "apiStartTime" which is in the following format 'Sat Mar 5 00:00:00 2016' including the apostrophes to an epoch time so I can perform some date calculations. strptime (timestamp, format, time_zone) This function parses a date string into a UNIX timestamp. Engager 03. conf to convert it to human readable. The timestamp is the number of 100-nanoseconds intervals (1 nanosecond = one billionth of a second) since. In Splunk, create a new TCP Data Input port for each log source type to beCOVID-19 Response SplunkBase Developers Documentation. Well SPLUNK (v 6. Try to determine which one is the best fit. I suggest you change your Splunk preferences to display time in UTC so you see the true time of the event. I have this date string example: Mon, 01 May 2023 00:00:00 GMT how can I convert it to epoch? thanks! On Splunk Enterprise instances, if you need to modify timestamp extraction, specify the configuration on the indexers. Playlist Link for All Daily Trainings. How to extract a value from fields when using stats() 0. Hello Splunk Community. I want to convert my default _time field to UNIX/Epoch time and have it in a different field. | gentimes start=-1 | eval YourDate="3:21:34 AM 12/8/2014" | table YourDate | eval COVID-19 Response SplunkBase Developers Documentation BrowseSolved: I have a field where the values are epoch times. Converting UNIX timestamps into dates and times. How to convert large epoch time to hours minutes and seconds ?. I'm trying to make a table of bookings from the whole 2019, my search is working as expected except for one column. index=someindex. Thanks Anyways SplunkBase Developers DocumentationUsing Splunk: Splunk Search: Convert log time (epoch) to readable Date and time; Options. You can convert String Time in your old format to Epoch Time in new format using strptime() and then convert to string time of your new format using strftime(). 0 Karma Reply. 2. This count starts at the Unix Epoch on January 1st, 1970 at UTC. Ex: Epoch time : 9386717. 04-26-2016 12:07 PM. I have an epoch time value (10 digit NUMBER) that I want to use as both rising column and timestamp for the event. I wish to work out the difference of these two times and then create an average of all the results - essentially this -> Average(Acknowledge_Date-Date_Created) SearchConvert time in CSV upload. I have unix time format on my log and wants to convert to human readable, the method using for epoch time didn't work for me. COVID-19 Response SplunkBase Developers Documentation. . conf to convert it to human readable. strptime() will convert strings to epoch times| eval _time=strptime(time,"%a, %d %b %Y %H:%M:%S %Z")Splunk Search: Convert Millseconds to Epoch Time; Options. So I have two date fields - Date_Created & Acknowledge_Date both in the format YYYY-MM-DD HH:MM:SS. I have a timestamp in the format "19-06-2015 07:00:00 Europe/London". strptime () and strftime () are functions you use to convert between string representation and unix timestamp. Splunk Tech Talks. In practice, Perl is often available:Subtracting DATE '1970-01-01' from the value will give the number of days (and fractional hours/minutes/seconds) difference and then you can multiply by 24*60*60: (date_value - DATE '1970-01-01')*24*60*60. One way would be to make use of the strptime()/strftime() functions of eval, which will let you convert time from strings, e. BrowseHi, I wonder whether someone may be able to help me please. eval time=tostring(filed_with_seconds, "duration") This will convert 134 to 00:02:14. It also assumes that you want to see this human readable time value in the current time zone of the user account. but just wanted to share that Powershell 7's Get-Date has native support for converting Unix time now (which I discovered thanks to this question). 531 AM As of Splunk 6. Using Splunk: Splunk Search: How to convert time to strptime? Options. I'm running the below query to find out when was the last time an index checked in. Once you convert the fields into epoch form so you can compare them they will be in epoch form. Hi, I wonder whether someone may be able to help me please. US Pacific Daylight Time, the timezone where Splunk Headquarters is located. Therefore, since you can generate timestamps in UTC, your best bet would be to have earliest and latest in epoch as well. 0. If the week containing January 1st has four or more days in the new year, it is considered week 1. Try: |eval startTime=strptime('apiStartTime',Hi, I wonder whether someone may be able to help me please. Try using this provided epoch time. View solution in. 04-07-2023 12:56 PM. This works perfectly. Splunk Administration. 0 coins. You can specify the time format by timeformat argument. In most cases, this won't matter but might be. So I have two date fields - Date_Created & Acknowledge_Date both in the format YYYY-MM-DD HH:MM:SS. Convert NT Epoch Time with props. Splunk Enterprise Security. This timestamp, which is the time when the event occurred, is saved in UNIX time. In 4. What setting should be placed in the props. Aug 8, 2019 at 23:48. 1) The question doesn't actually provide a standard epoch time. But remember that instead of creating a field with string representation of a date you can do a fieldformat, so that internally splunk manipulates the timestamp as integer (it's much easier to do date arithmetics. | eval Ingestion_Time_Logged=strftime( The epoch to convert is determined by a case statement. Tags: epoch. %X The time in the. Community; Community; Splunk Answers. I have a logs where time stores under a custom field (Patch_date) and i want to display latest time result. Browse . When used on the _time field it returns the difference in seconds. Solved: I want to get the result of large epoch time to hours minutes and seconds. The general workflow for creating a CSV lookup in Splunk Web is to upload a file, share the lookup table file, and then create the lookup definition from the lookup table file. e _time) is in UTC. Community Blog; Product News & Announcements; Career Resources;. The epoch value is obviously shorter in length, which is always good for mobile data usage, and it's pretty simple to convert between epoch values and the language's local Date type variable. I think you may have found a bug. This function takes a time represented by a string and parses the time into a UNIX timestamp format. splunk date time difference. I had taken a look at it and it wont work the way it should, Instead I created a new custom code only one to convert the date format. When used in a search, this function returns the UNIX time when the. The UNIX Epoch Time timestamp, or the number of seconds since the Epoch: 1970-01-01 00:00:00 +0000 (UTC). conf to have the data indexed with the time field converted for human readability. I have a file that I am monitoring has time in epoch format milliseconds . The strptime function doesn't work with timestamps that consist of only a month and year. The rt field is a epoch computer time format. 0. conf to convert these all to the timestamp for the events? An example of the first couple fields in the event are: rec_type=500 rec_type_simple="FILELOG EVENT" event_sec=1453991513. GMT and UTC. . | tstats latest(_time) WHERE index=* BY index I think Splunk strptime () is converting the timezone. If you leave that field name alone, it will "magically" convert it to human readable for you. If the indexer runs on a different timezone from the source machines, e. An epoch is a numeric value representing time in seconds. 7 Python 2. In general what you want to do is take the separate fields, combine them into one field, and then use a conversion function to parse the represented time into epoch format and store that as _time. Splunk, Splunk>, Turn Data Into Doing, Data-to-Everything, and. Yes 13 Digits is not supported by Splunk only 10 Digits with EPOCH is supported by Splunk API. Considering converting from epoch is one of the most common Splunk questions of all time, considering this page has 46k views, and considering that each and every answer is entirely incorrect (and the actual question itself is misleading) this page is desperately in need of removal. index=someindex source="mysource" | eval. Browse . Solved: Hi, i need to write a query that converts time format from minutes to format Xh Xmin Xs my query | eval finish_time_epoch =Seems like your search results include the _time field which shows human-readable format in Splunk visualizations (it's a special field) but holds an epoch value. Jan 01, 1971 is 31557600 as you noticed, so you'd think that Dec 31st 1970 would be 31557600-86400, an answer which escapes my ability to run a calculator app right now, but which is decidedly greater than 0. 0 Karma. Then you can subtract them to get the difference in seconds. I tried to convert 1:00 AM and 8:00 AM to epoch time, and for some reason, the epoch time of 1:00 AM is greater than the epoch time of 8:00 AM. The converted time field is renamed ms_time. g. Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type. The time returned by the now () function is represented in UNIX time, or in seconds since Epoch time. Solved: Hi I need to Convert an #epoch time to #minutes any ideas please guys would be really grateful - Thanks There are a couple of ways to convert epoch time into a human-readable format, but first you must start with epoch time in seconds rather than milliseconds. You can also use these variables to describe timestamps in event data. This moment in time is sometimes referred to as epoch time. The first works fine , but getting it to use this for the event timestamp not. The UNIX Epoch Time timestamp, or the number of seconds since the Epoch: 1970-01-01 00:00:00 +0000 (UTC). A. This solution doesn't appear to account for timezone, which Splunk automatically adjusts for. How to convert epoch time with milliseconds into splunk at indexing time vrmandadi. Here, we're setting the value of the Ingestion_Time_logged field to the result of the strftime function. . Solved: I am creating some of my first dashboards, and I am having trouble working out how to change the output in the column titled Time to COVID-19 Response SplunkBase Developers Documentation BrowseTry the following where the seconds you are adding are what you have form your EPOCH date. if it's another time field you are working with, you need to make sure you convert your time into epoch time before extracting the month, like you are doing in the second example. What is the splunk query to convert java date format to yyyy-MM-dd. | eval _time=strptime (date_field, "format_string") which will overwrite the. I am looking to format my current time to epoch time (as we need to calculate some math function on time) Time format for incidentEndTimeStr looks like this: 4/11/16 2:52 And used the eval command and strptime function below to change the format, but it doesn't work. SSS (minutes, seconds, and subseconds) to a number in seconds. Splunk does not have a function for converting time zones. Hope this helps, d. Is there a way to fix this so that Splunk understands the 18 characters? The source for the dashboard is the following:The problem is that you are setting earliest_time and latest_time - but Splunk does not know how to relate that to the _time field that you have defined in your lookup table. Subsecond time variables such as %N and %Q can be used in metrics searches of metrics indexes that are enabled for millisecond timestamp resolution. For example, the relative time 2 hours from a start time of 2:00 PM would be 12:00 PM. Any help is appreciated. I wish to work out the difference of these two times and then create an average of all the results - essentially this -> Average (Acknowledge_Date-Date_Created) Search. How to convert epoch time with milliseconds into splunk at indexing time. The timestamp processorSolved: Is it possible to convert the following into an epoch timestamp using strptime; 2018-05-31T06:49:13Z Or will I need to use regex to rip out. However, in using this query the output reflects a time format that is in EPOC format. You use date and time variables to specify the format that matches string. Subscribe to RSS Feed; Mark Topic as New; Mark Topic as Read; Float this Topic for Current User;This field is generated via the Splunk logging library, as I explained in my first entry here. 04-26-2016 12:07 PM. Too early on a Monday. e. I tried all the options and unable to see date in human readable format. Go to to suggest one or to up-vote someone else's idea. %V - ISO week number of the year [1-53]. %T How to convert time to epoch time? What the best approach for this one? Mon 07/23/2018 17:19:01. Before going through the pin of converting epoch, maybe the "delta" command will do what you are looking to achieve. The mstime () function converts the _time field values from a minutes and seconds to just seconds. Community; Community;. This is an alternative option of strptime() function in eval functions. 1. Thank you. The timestamp processor Solved: Is it possible to convert the following into an epoch timestamp using strptime; 2018-05-31T06:49:13Z Or will I need to use regex to rip out COVID-19 Response SplunkBase Developers Documentation Hi How to convert the time format "2016-12-07T09:33:33. 1. @kiran331, you would also need to confirm as to what is your Time field name and whether it is epoch timestamp or string timestamp. It's seconds, counting upward from January 1st, 1970. 0. You need to, at index time, set the time zone of your incoming data so that Splunk knows what the actual real event time is. 1) The question doesn't actually provide a. %T The time in 24-hour notation (%H:%M:%S). I tri. Which in this case comes out to January 1, 2016. I had taken a look at it and it wont work the way it should, Instead I created a new custom code only one to convert the date format. Solved: I can't seem to convert epoch time when using timechart. floor ( (new Date). BrowseYou could add a time range picker and feed your tokens into that, that way the user can both see the time range (to some degree) and manipulate it as COVID-19 Response SplunkBase Developers DocumentationFor data already indexed, you can use Eval's strptime OR the convert command to switch this to epoch. It uses the timezone of the logged in user instead of the server local time. This should be used in day today basis and how to convert timestamp in to date, month and year. time. Path Finder 01. If you want to do it in JS use something like var epoch = Math. It uses the timezone of the logged in user instead of the server local time. You can follow this document to set up a lookup: Use lookups in Splunk Web; per Define a CSV lookup in Splunk Web: CSV lookups are best for small sets of data. | tstats latest(_time) WHERE inde. _time is always stored in the Splunk indexes as an epoch time value. I'm extracting a time stamp in the format 2015-01-31T23:59:55. Hi and thanks in advance, I am trying to convert the following time example field: 2017-03-02T09:41:38. The general workflow for creating a CSV lookup in Splunk Web is to upload a file, share the lookup table file, and then create the lookup definition from the lookup table file. e. You could just create one event instead of three, or in the example, just return the first event:| head 1 If you're working with ISO time strings but unknown times in an unknown order, you can sort lexicographically:| sort time_1 | head 1 If the time format is known but not necessarily in ISO format. This is why I am trying to convert it before it is indexed. Solved! Jump to solution. 89 mktime – Convert human readable time format epoch time format. For example, both of these are the same: Epoch = 1511324473 iso8601 = 2017-11-22T04:21:13Z. The epoch time is reflecting in the events,I am extracting using regex in the search and after that trying to convert the epoch time and use it in the search. Use timeformat option to specify exact format to convert from. Description This function takes no arguments and returns the time that the search was started. . With daylight saving, CET is two hours ahead of UTC. UNIX time is the number of seconds that have elapsed since 00:00:00 Coordinated Universal Time (UTC), 1 January 1970. 04-07-2023 12:56 PM. 1430167363808 or 1430167236667 it is. ctime – Convert an epoch time format to human readable time format. If you want to see the actual epoch time value, you can use eval to create an epoch time representation instead: | eval time_epoch = strftime (_time, "%s") As @mdsnmss suggested, you could also do. Solved: A user tells us - -- I need to convert time value from EST to UTC in Splunk. Solved: I have a conversion set up to change the epoch time | convert ctime(_time) as date time . 281Z which I'm trying to convert to an epoch time. It is not showing any value in the human readable time column. Any operation done with value of _time is already in epoch. I have this on my log including epoch time, how I can convert the time next to msg to readable time. Used in calculating the day of the year. struct_time does not support sub-second precision. UNIX time is the number of seconds that have elapsed since 00:00:00 Coordinated Universal Time (UTC), 1 January 1970. It is not showing any value in the human readable time column. Epoch and unix timestamp converter for developers. | eval epoch1 = _time. Hello Friends, Welcome back to my channel. xxx]Downvoted. BrowseWhen using time. I'd like to convert it to a standard month/day/year format. I tried below but that doesn't worked, base search |search Patch_date=latest(Patch_date) |table Patch_date,region,server,os_type,lo. E. I have a file that I am monitoring has time in epoch format milliseconds . The timestamps must include a day. ---Most of my log sources reports in 12 character Epoch time but I do have a few that reports in 18 character epoch time. For example the UNIX epoch time 1484993700 is equal to Tue Jan 21 10:15:00 2020 . if you are wanting to extract month from event time, Splunk already does this for you by storing the month in date_month field. I have following Splunk Query which is trying to format Epoch captured start and end time into human readable format but seems like splunk is pulling incorrect value here. Awesome. The Unix epoch (or Unix time or POSIX time or Unix timestamp) is the number of seconds that have elapsed since January 1, 1970 (midnight UTC/GMT), not counting leap seconds (in ISO 8601: 1970-01-01T00:00:00Z). How do I perform this conversion from microseconds to a time unit in Splunk? Here. I have a Field that contains values in the YYYY-MM-DD. It also lets you do the inverse, i. Note that the earliest and latest params are set to Epoch time. Builder 03-26-2020 09:26 AM. Solved: I have an event field called `LastBootUpTime=20120119121719. I want to convert Epoch time appearing in my events in a field but I want to convert it at index time so that when I search for events instead of. The idea is that a user clicks on a field in a table row result, and the click opens a new tab to a separate dashboard w. The Splunk Universal Forwarder may assign different sourcetype values for logs from the same source. , mm/dd/yyyy hr:min:sec? I have tried to convert them to datetime. Is there a command to execute this, or does it all need to be done using simple math? Tags (2) Tags: convert. I can reproduce proper results with any date in 1971 or newer, but none in 1970. | eval humanTime = strftime(_time/1000, "%c") @goyals05, I hope the above example is timestamp is String Time and not Epoch Time. Subscribe to RSS Feed; Mark Topic as New; Mark Topic as Read; Float this Topic for Current User;. Hi , I have two date formats i have to subtract to find the time duratiuon. 33. It's almost time for Splunk’s user conference . Any help is appreciated. I also don't want to start new search for just parsing timestamps (it has to be fast). What setting should be placed in the props. 2/7/18 3:35:10. That shows the desired five but there might be a better way. You can use either convert mktime () or the eval strptime () functions to convert both timestamps to epoch time, then just subtract one from the other. I am trying to convert the string "08/04/16 09:40:41. Thanks.