topic Convert datetime(in user format) extracted from field to splunk understandable format in Getting Data In

Convert datetime(in user format) extracted from field to splunk understandable format

adityapavan18 — Fri, 25 Nov 2011 10:53:34 GMT

I have time logged in as the below format
....
2011-11-18T00:00:00
....

I am able to extract that time using field extraction to get
OrderDate as 2011-11-18T00:00:00

Is there any way to convert that value to format

2011/11/18 00:00:00

The reason for this is i need to find diffrence between times, and i cannot do it if time is in format of 2011-11-18T00:00:00
Please suggest me ideas to implement this.

Re: Convert datetime(in user format) extracted from field to splunk understandable format

Ayn — Fri, 25 Nov 2011 11:49:05 GMT

... | eval ReformattedOrderDate=strptime(OrderDate,"%Y-%m-%dT%H:%M:%S")

This will return the corresponding epoch value for the timestamp, which should be appropriate to use when comparing times. If you want to use another time, use eval again with strftime.

Re: Convert datetime(in user format) extracted from field to splunk understandable format

adityapavan18 — Tue, 29 Nov 2011 15:15:12 GMT

thanks a lot for the help