Related Answers
Download topic as PDF
reltime
Description
Adds a new field to your search results, called reltime, and sets this field to a human readable value of the difference between now and _time.
The human-readable values look like "5 days ago", "1 minute ago", "2 years ago", and so on.
Syntax
reltime
Usage
The reltime command is a distributable streaming command. See Command types.
The reltime command returns relative times in seconds, minutes, hours, days and years. For example, 12 seconds ago.
The reltime command changes the time unit when a threshold has been passed. If the time difference between a timestamp and "now" does not meet the next threshold the smaller time unit is used. For example, if you have a timestamp and only 23 hours and 59 seconds have passed, the relative time displays hours instead of days. When exactly 24 hours have passed, the relative time still displays hours. Only when 24 hours and 1 second have passed will the relative time display 1 day ago.
Examples
1. Show the relative time for each event
Consider the following set of timestamps:
| _time |
|---|
| 2021-06-11 14:35:58 |
| 2021-06-10 14:35:58 |
| 2021-06-08 14:35:58 |
| 2021-04-12 14:35:58 |
| 2021-04-12 14:35:59 |
When you add the reltime command to the end of the search, a field is added to the events. The relative time difference between the _time field and now is calculated and added to the new field.
If today is 2021-06-11 14:35:58, the results look something like this:
| _time | reltime |
|---|---|
| 2021-06-11 14:35:58 | now |
| 2021-06-10 14:35:58 | 1 day ago |
| 2021-06-08 14:35:58 | 3 days ago |
| 2021-04-12 14:35:58 | 1 month ago |
| 2021-04-12 14:35:59 | 2 months ago |
The difference between 2021-06-11 and 2021-04-12 is 60 days. Notice that the reltime column says 1 month ago for the first April 12th timestamp. The relative time won't display 2 months ago until exactly 60 days and 1 second have pasted.
See also
|
PREVIOUS regex |
NEXT rename |
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.7, 7.0.10, 7.0.11, 7.0.13, 6.5.2, 6.3.1, 7.0.6, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 7.0.8, 7.0.9
Feedback submitted, thanks!