https://community.splunk.com/t5/Getting-Data-In/How-do-I-include-leading-0-in-the-time-fields/m-p/28939#M4983 <P>The best way if possible is to convert or use epoch time with in your search. Then use <STRONG>strftime</STRONG> eval funtion to convert to the desired format.</P> <P><CODE></CODE><PRE><CODE><BR /> eval time = strftime(epoch,%H:%M:%S)<BR /> </CODE></PRE></P> <P>additional reading:</P> <UL> <LI><A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Commontimeformatvariables">Commontimeformatvariables</A></LI> <LI><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions">CommonEvalFunctions</A></LI> </UL> <P>Hope this help or gets you started. Dont forget to vote and accept answer that help.</P> <P>Cheers</P> Thu, 09 May 2013 17:21:49 GMT bmacias84 2013-05-09T17:21:49Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-include-leading-0-in-the-time-fields/m-p/28938#M4982 <P>I would like to combine the date_hour, date_minute and date_second fields to display in the following format when using the top command: hh:mm:ss</P> <P>The problem I'm having is that the output will remove any leading zeros from the minutes; so, for example instead of 12:05:02 I get 12:5:2.</P> <P>This how I'm currently combining the fields:</P> <PRE><CODE>mysearch | eval time = date_hour.":".date_minute.":".date_second | top time,src,src_port,dest,dest_port </CODE></PRE> Mon, 28 Sep 2020 13:52:15 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-include-leading-0-in-the-time-fields/m-p/28938#M4982 digital_alchemy 2020-09-28T13:52:15Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-include-leading-0-in-the-time-fields/m-p/28939#M4983 <P>The best way if possible is to convert or use epoch time with in your search. Then use <STRONG>strftime</STRONG> eval funtion to convert to the desired format.</P> <P><CODE></CODE><PRE><CODE><BR /> eval time = strftime(epoch,%H:%M:%S)<BR /> </CODE></PRE></P> <P>additional reading:</P> <UL> <LI><A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Commontimeformatvariables">Commontimeformatvariables</A></LI> <LI><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions">CommonEvalFunctions</A></LI> </UL> <P>Hope this help or gets you started. Dont forget to vote and accept answer that help.</P> <P>Cheers</P> Thu, 09 May 2013 17:21:49 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-include-leading-0-in-the-time-fields/m-p/28939#M4983 bmacias84 2013-05-09T17:21:49Z