<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: convert timeformat with 21h as 00h in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/convert-timeformat-with-21h-as-00h/m-p/193371#M38556</link>
    <description>&lt;P&gt;There seems to be something a little off in your example returns.  The two timestamps should have differences much smaller than the values shown.  On my system, the search you provided yields a media value of 2372 seconds which equates to Thu, 01 Jan 1970 00:39:32 GMT.  The ctime command is converting that time to your local timezone which is why you see 21 instead of 00.&lt;/P&gt;

&lt;P&gt;As a workaround, format the difference 'manually':&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;... | eval media=update-data | eval min=floor(media/60) | eval secs=media%60 | eval media=min.":".secs | ...
&lt;/CODE&gt;&lt;/PRE&gt;</description>
    <pubDate>Mon, 06 Jul 2015 15:02:27 GMT</pubDate>
    <dc:creator>richgalloway</dc:creator>
    <dc:date>2015-07-06T15:02:27Z</dc:date>
    <item>
      <title>convert timeformat with 21h as 00h</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/convert-timeformat-with-21h-as-00h/m-p/193370#M38555</link>
      <description>&lt;P&gt;Hi guys, i have this search:&lt;/P&gt;

&lt;P&gt;| dbquery PROD-UOL7-MANUT-MONITORACAO &lt;BR /&gt;
"select &lt;BR /&gt;
dat_collect_transaction as \"data\",&lt;BR /&gt;
dat_update as \"update\",&lt;BR /&gt;
idt_inscription_account as \"conta\"&lt;BR /&gt;
from collect_transaction&lt;BR /&gt;
where idt_payment_method = 221 and dat_collect_transaction &amp;gt; sysdate -15 and dat_collect_transaction &amp;lt; sysdate-1"&lt;BR /&gt;
| eval media=update-data&lt;BR /&gt;
| convert timeformat="%Y/%m/%d %H:%M:%S" ctime(data) ctime(update)&lt;BR /&gt;
| convert timeformat="%H:%M:%S" ctime(media)&lt;/P&gt;

&lt;P&gt;but this is what return:&lt;BR /&gt;
2015/06/21 10:11:33 2015/06/21 10:51:05 31298717    21:39:32&lt;BR /&gt;
2015/06/21 10:12:34 2015/06/21 10:12:40 41224153    21:00:06&lt;/P&gt;

&lt;P&gt;I dont understand why get set to 21h as 00h, anyone have this issue?&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 06:36:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/convert-timeformat-with-21h-as-00h/m-p/193370#M38555</guid>
      <dc:creator>felipesewaybric</dc:creator>
      <dc:date>2020-09-29T06:36:22Z</dc:date>
    </item>
    <item>
      <title>Re: convert timeformat with 21h as 00h</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/convert-timeformat-with-21h-as-00h/m-p/193371#M38556</link>
      <description>&lt;P&gt;There seems to be something a little off in your example returns.  The two timestamps should have differences much smaller than the values shown.  On my system, the search you provided yields a media value of 2372 seconds which equates to Thu, 01 Jan 1970 00:39:32 GMT.  The ctime command is converting that time to your local timezone which is why you see 21 instead of 00.&lt;/P&gt;

&lt;P&gt;As a workaround, format the difference 'manually':&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;... | eval media=update-data | eval min=floor(media/60) | eval secs=media%60 | eval media=min.":".secs | ...
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Mon, 06 Jul 2015 15:02:27 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/convert-timeformat-with-21h-as-00h/m-p/193371#M38556</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2015-07-06T15:02:27Z</dc:date>
    </item>
    <item>
      <title>Re: convert timeformat with 21h as 00h</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/convert-timeformat-with-21h-as-00h/m-p/193372#M38557</link>
      <description>&lt;P&gt;| dbquery PROD&lt;BR /&gt;&lt;BR /&gt;
"select  dat_collect_transaction as \"data\", dat_update as \"update\", idt_inscription_account as \"conta\" from collect_transaction where idt_payment_method = 221 and dat_collect_transaction &amp;gt; sysdate -15 and dat_collect_transaction &amp;lt; sysdate-1"&lt;BR /&gt;
| eval intervalo=update-data &lt;BR /&gt;
| convert timeformat="%Y/%m/%d" ctime(data)&lt;BR /&gt;
| eval Date=strftime(strptime(data,"%Y/%m/%d"), "%d/%m/%Y")&lt;BR /&gt;
| eventstats avg(intervalo) as Intervalo &lt;BR /&gt;
| eval Intervalo = Intervalo*2 &lt;BR /&gt;
| stats count(eval(intervaloIntervalo)) as "Acima do tempo medio"  by Date&lt;BR /&gt;
| eval data_sort = strftime(strptime(Date,"%d/%m/%Y"), "%m/%d")&lt;BR /&gt;
| sort 15 - data_sort | reverse&lt;BR /&gt;
| table  Date, "Acima do tempo medio", "Dentro do tempo medio"&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 06:37:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/convert-timeformat-with-21h-as-00h/m-p/193372#M38557</guid>
      <dc:creator>felipesewaybric</dc:creator>
      <dc:date>2020-09-29T06:37:22Z</dc:date>
    </item>
  </channel>
</rss>

