topic Re: How to uniform format for timestamp? in Splunk Enterprise

How to uniform format for timestamp?

manimuthu — Fri, 01 Apr 2022 19:35:41 GMT

Hi All,

after querying and grouping my data, my timestamp is of different format like

2021-01-20 07:22:34.545674

2020-02-18T11:03:44.543+0000

2021-01-25T11:05:33.003Z

2022-04-01 19:51:01.411826Z

2021-05-22 02:49:26.607839

How to have a uniform format for all the timestamp values in the stats table

Re: How to uniform format for timestamp?

VatsalJagani — Sat, 02 Apr 2022 06:21:47 GMT

It seems like your timestamps are coming as string values in some field (for example my_timestamp) You need to handle each date format and then combine everything with coalesce.

| eval time1=strptime(my_timestamp, "%F %T.%6N") | eval time2=strptime(my_timestamp, "%FT%T.%3NZ") .... | eval my_timestamp=coalesce(time1, time2, time3, ....) | eval my_timestamp=strftime(my_timestamp, "%F %T")

See date-time format parameters - https://docs.splunk.com/Documentation/Splunk/8.2.5/SearchReference/Commontimeformatvariables

Re: How to uniform format for timestamp?

PickleRick — Sat, 02 Apr 2022 10:45:22 GMT

Where do these timestamps come from? It's a relatively rare situation that you need to use the timestamp from a different part of event than _time field if the event is properly parsed.

I'm not saying it doesn't happen but it's relatively rare.

Re: How to uniform format for timestamp?

manimuthu — Sat, 02 Apr 2022 19:56:24 GMT

Thanks a lot for all the replies. Actually instead of using timestamps that are coming as string values in some field, i used _time so, that helped me to avoid these different timestamp's formats issue.

Actually

| eval my_timestamp=strftime(my_timestamp, "%F %T")

this line helped me a lot . Really thanks for all who took their precious time and efforts to help me

Re: How to uniform format for timestamp?

VatsalJagani — Sun, 03 Apr 2022 15:28:37 GMT

If the answer helped you kindly consider accepting the answer!!!