https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-time-format-from-my-log-parser-to-Splunk/m-p/250980#M48329 <P>Could you provide the current value of timestamp that you're getting now and what you want to it to transform into (with actual examples)?</P> Wed, 18 May 2016 14:28:48 GMT somesoni2 2016-05-18T14:28:48Z https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-time-format-from-my-log-parser-to-Splunk/m-p/250975#M48324 <P>Hi,</P> <P>I am converting all statements from my log parser tool to Splunk. I didn't get the exact conversion for date and time timezone format.</P> <P>Please find my search here from log parser.</P> <P>Log parser:</P> <PRE><CODE>TO_LOCALTIME(QUANTIZE(TO_TIMESTAMP(date, time), 1)) as Second, COUNT(*) </CODE></PRE> <P>I want to convert above statement into Splunk syntax format.</P> <P>Please help me on this.</P> Mon, 16 May 2016 14:48:07 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-time-format-from-my-log-parser-to-Splunk/m-p/250975#M48324 guruwells 2016-05-16T14:48:07Z https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-time-format-from-my-log-parser-to-Splunk/m-p/250976#M48325 <P>How does your timestamp looks like , samples?? (you probably need to use function strptime)</P> Mon, 16 May 2016 15:33:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-time-format-from-my-log-parser-to-Splunk/m-p/250976#M48325 somesoni2 2016-05-16T15:33:05Z https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-time-format-from-my-log-parser-to-Splunk/m-p/250977#M48326 <P>Thanks for the reply. I am looking for date format which is " 2015-06-15 00:00*<EM>:01</EM>*". something I need to seconds data.</P> <P>Let me know if you need any info on this.</P> Tue, 29 Sep 2020 09:42:38 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-time-format-from-my-log-parser-to-Splunk/m-p/250977#M48326 guruwells 2020-09-29T09:42:38Z https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-time-format-from-my-log-parser-to-Splunk/m-p/250978#M48327 <P>YOu would need to use strptime funtion like this (run anywhere sample, replace line 1 with your search. Mine just generates dummy row)</P> <PRE><CODE>| gentimes start=-1 | eval YourDateField="2015-06-15 00:00:01" | table YourDateField | eval YourDateInEpoch=strptime(YourDateField,"%Y-%m-%d %H:%M:%S") | eval YourSecondPart=strftime(YourDateInEpoch,"%S") </CODE></PRE> Mon, 16 May 2016 16:29:48 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-time-format-from-my-log-parser-to-Splunk/m-p/250978#M48327 somesoni2 2016-05-16T16:29:48Z https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-time-format-from-my-log-parser-to-Splunk/m-p/250979#M48328 <P>Thanks for the quick reply on this. It's really appreciated. what I am doing here is. I am pulling iis log information. I have separate fields which are date and time from my log. first thing is I need to get date and time and same time I need to convert that date into local time.<BR /> TO_LOCALTIME(QUANTIZE(TO_TIMESTAMP(date, time), 1)) as Second</P> <P>Your help is appreciated.</P> Tue, 29 Sep 2020 09:42:41 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-time-format-from-my-log-parser-to-Splunk/m-p/250979#M48328 guruwells 2020-09-29T09:42:41Z https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-time-format-from-my-log-parser-to-Splunk/m-p/250980#M48329 <P>Could you provide the current value of timestamp that you're getting now and what you want to it to transform into (with actual examples)?</P> Wed, 18 May 2016 14:28:48 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-time-format-from-my-log-parser-to-Splunk/m-p/250980#M48329 somesoni2 2016-05-18T14:28:48Z https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-time-format-from-my-log-parser-to-Splunk/m-p/250981#M48330 <P>Hi,<BR /> Thanks for the reply. My time format in log file is "2016-01-10 08:00:00 ( Pacific time) and I wanted to convert date and time into Eastern time ( example: 2016-01-10 00:00:00). In above statement I am trying to convert server time to local time. </P> <P>is this information is good enough?. date and time field are seperate fields here.<BR /> One more question is here: shall we use "_time" field to retrieve data?</P> Thu, 19 May 2016 11:35:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-convert-date-time-format-from-my-log-parser-to-Splunk/m-p/250981#M48330 guruwells 2016-05-19T11:35:05Z