Splunk® Enterprise

Search Reference

Download manual as PDF

Download topic as PDF

Date and Time functions

The following list contains the functions that you can use to calculate dates and time.

For information about using string and numeric fields in functions, and nesting functions, see Evaluation functions.

In addition to the functions listed in this topic, there are also variables and modifiers that you can use in searches.

now()

Description

This function takes no arguments and returns the time that the search was started.

Usage

The now() function is often used with other data and time functions.

The time returned by the now() function is represented in UNIX time, or in seconds since Epoch time.

When used in a search, this function returns the UNIX time when the search is run. If you want to return the UNIX time when each result is returned, use the time() function instead.

You can use this function with the eval, fieldformat, and where commands, and as part of eval expressions.

Basic example

The following example combines determines the UNIX time value of the start of yesterday, based on the value of now().

... | eval n=relative_time(now(), "-1d@d")

Extended example

If you are looking for events that occurred within the last 30 minutes you need to calculate the event hour, event minute, the current hour, and the current minute. You use the now() function to calculate the current hour (curHour) and current minute (curMin). The event timestamp, in the _time field, is used to calculate the event hour (eventHour) and event minute (eventMin). For example:

... earliest=-30d | eval eventHour=strftime(_time,"%H") | eval eventMin=strftime(_time,"%M") | eval curHour==strftime(now(),"%H") | eval curMin=strftime(now(),"%M") | where (eventHour=curHour and eventMin > curMin - 30) or (curMin < 30 and eventHour=curHour-1 and eventMin>curMin+30) | bucket _time span=1d | chart count by _time

relative_time(X,Y)

Description

This function takes an UNIX time, X, as the first argument and a relative time specifier, Y, as the second argument and returns the UNIX time value of Y applied to X.

Usage

You can use this function with the eval, fieldformat, and where commands, and as part of eval expressions.

Basic example

The following example determines the UNIX time value of the start of yesterday, based on the value of now().

... | eval n=relative_time(now(), "-1d@d")

strftime(X,Y)

Description

This function takes a UNIX time value, X, as the first argument and renders the time as a string using the format specified by Y.

Usage

For a list and descriptions of format options, see Common time format variables.

You can use this function with the eval, fieldformat, and where commands, and as part of eval expressions.

Basic example

The following example returns the hour and minute from the _time field.

... | eval n=strftime(_time, "%H:%M")


strptime(X,Y)

Description

This function takes a time represented by a string, X, and parses it into a timestamp using the format specified by Y.

Usage

For a list and descriptions of format options, see Common time format variables.

You can use this function with the eval, fieldformat, and where commands, and as part of eval expressions.

Basic example

If the values in the timeStr field are hours and minutes, such as 11:59, the following example returns the time as a timestamp:

... | eval n=strptime(timeStr, "%H:%M")

time()

Description

This function returns the wall-clock time with microsecond resolution.

Usage

The value of the time() function will be different for each event, based on when that event was processed by the eval command.

You can use this function with the eval, fieldformat, and where commands, and as part of eval expressions.

Basic example

PREVIOUS
Cryptographic functions
  NEXT
Informational functions

This documentation applies to the following versions of Splunk® Enterprise: 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 7.0.0, 7.0.1


Comments

Hello Badgriff16

Thank you for reaching out to us about using Splunk!

Depending on what you are trying to do, you can use either the timechart or the bin command.

timechart count by host span=month

Or

bin _time span=month | stats count by _time host

Lstewart splunk, Splunker
December 18, 2017

I am new to Splunk and I am still learning how to write the correct syntax to gather the right information, but I am having issues. If I am trying to find the Total access attempts by month by host and the total failed access attempts by month by host how would I need to write the syntax for? I can't seem to find anything that helps me on this.

Badgriff16
December 11, 2017

It would be REALLY nice if we could specify "GMT" or another valid timezone specifier to return the offset of my personal TZ to the specified TZ. We need to normalize to GMT for some stuff (to make the search user-TZ-agnostic) and we have to do some silly stuff.

Woodcock
November 14, 2017

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters