topic Re: How do I convert the format of this timestamp in Splunk? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-do-I-convert-the-format-of-this-timestamp-in-Splunk/m-p/233167#M45476 <P>You can use eval strftime and strptime for those types of changes: <A href="http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/CommonEvalFunctions</A>.</P> <P>Is the time you specified in the _time field or in another field?</P> Tue, 28 Jun 2016 19:32:51 GMT gfreitas 2016-06-28T19:32:51Z How do I convert the format of this timestamp in Splunk? https://community.splunk.com/t5/Getting-Data-In/How-do-I-convert-the-format-of-this-timestamp-in-Splunk/m-p/233166#M45475 <P>How do I convert <CODE>2016-06-17T14:16</CODE> to <CODE>2016-06-17 14:16:00</CODE> format in Splunk? Appreciate your help.</P> Tue, 28 Jun 2016 18:52:18 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-convert-the-format-of-this-timestamp-in-Splunk/m-p/233166#M45475 vamsivasili 2016-06-28T18:52:18Z Re: How do I convert the format of this timestamp in Splunk? https://community.splunk.com/t5/Getting-Data-In/How-do-I-convert-the-format-of-this-timestamp-in-Splunk/m-p/233167#M45476 <P>You can use eval strftime and strptime for those types of changes: <A href="http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/CommonEvalFunctions</A>.</P> <P>Is the time you specified in the _time field or in another field?</P> Tue, 28 Jun 2016 19:32:51 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-convert-the-format-of-this-timestamp-in-Splunk/m-p/233167#M45476 gfreitas 2016-06-28T19:32:51Z Re: How do I convert the format of this timestamp in Splunk? https://community.splunk.com/t5/Getting-Data-In/How-do-I-convert-the-format-of-this-timestamp-in-Splunk/m-p/233168#M45477 <P>It is another field I've extracted. In that case how do I convert?</P> Tue, 28 Jun 2016 19:52:57 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-convert-the-format-of-this-timestamp-in-Splunk/m-p/233168#M45477 vamsivasili 2016-06-28T19:52:57Z Re: How do I convert the format of this timestamp in Splunk? https://community.splunk.com/t5/Getting-Data-In/How-do-I-convert-the-format-of-this-timestamp-in-Splunk/m-p/233169#M45478 <P>If you just want to remove the "T", you can use:</P> <BLOCKQUOTE> <P>| eval field2=replace(field1, "T", " ")</P> </BLOCKQUOTE> Tue, 28 Jun 2016 20:01:09 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-convert-the-format-of-this-timestamp-in-Splunk/m-p/233169#M45478 gfreitas 2016-06-28T20:01:09Z