topic timestamp conversion in Getting Data In

timestamp conversion

Jananee_iNautix — Mon, 20 Jan 2014 09:01:25 GMT

Hi ,
I want to convert the
Input :2013-12-09 18:11:34
Input :13-12-09 18:11:34
I want a common regex to convert the above format to the below format
Output:Thu December 2013 12 18:11:34.
I tried with the regex | eval m=strptime(timestamp,"%Y-%m-%d")|eval timestamp=strftime(m,"%B %Y")|table timestamp
But it is converting only the timestamp with the format 2013-12-09 18:11:34 and not 13-12-09 18:11:34.

Re: timestamp conversion

lguinn2 — Mon, 20 Jan 2014 09:18:36 GMT

Try this

yoursearchhere
| eval outputTimestamp = if (match(timestamp,"\d{2}-\d{2}-\d{2} \d{2}\:\d{2}\:\d{2}"),
            strptime(timestamp,"%y-%m-%d %H:%M:%S"),strptime(timestamp,"%Y-%m-%d %H:%M:%S"))
| eval outputTimestamp = strftime(outputTimestamp,"%a %b %Y %d %H:%M:%S")
| table timestamp outputTimestamp

Re: timestamp conversion

Ayn — Mon, 20 Jan 2014 10:00:19 GMT

If these are timestamps in your input, aren't they the timestamp that Splunk uses in its own timestamp recognition? I think you might be making this more complicated than it needs to be.

Re: timestamp conversion

Jananee_iNautix — Tue, 21 Jan 2014 12:55:03 GMT

Thanks a lot...it is working