https://community.splunk.com/t5/Getting-Data-In/How-to-convert-my-date-and-time-field-into-a-human-readable/m-p/281648#M53859 <P>Get rid of your quotes</P> <PRE><CODE>|stats count | fields - count | eval StartTime="2017-02-05T10:02:00.000-0800" | fieldformat StartTime=strftime(strptime(StartTime,"%Y-%m-%dT%H:%M:%S.%3N%z"),"%m-%d-%Y %H:%M %p") | table StartTime </CODE></PRE> Wed, 08 Feb 2017 04:19:51 GMT splunker1981 2017-02-08T04:19:51Z https://community.splunk.com/t5/Getting-Data-In/How-to-convert-my-date-and-time-field-into-a-human-readable/m-p/281643#M53854 <P>First, I read similar Question/Answers and was able to follow them for other time formats. These work well but didn't address the specific format my timestamp is in.</P> <P>Use Case:<BR /> I have a field called "StartTime" and it has time in the following format: 2017-02-05T10:02:00.000-0800 </P> <P>I would like this to be converted for all fields so that when I table "StartTime" I get human readable format. I will be doing the same conversion for a field called "EndTime" which is in the same format.</P> <P>Any help is appreciated.</P> Tue, 07 Feb 2017 22:04:39 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-convert-my-date-and-time-field-into-a-human-readable/m-p/281643#M53854 aaronevil 2017-02-07T22:04:39Z https://community.splunk.com/t5/Getting-Data-In/How-to-convert-my-date-and-time-field-into-a-human-readable/m-p/281644#M53855 <P>What do you mean by human readable, can you provide an example of what you'd like the end result to look like</P> Tue, 07 Feb 2017 22:19:47 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-convert-my-date-and-time-field-into-a-human-readable/m-p/281644#M53855 splunker1981 2017-02-07T22:19:47Z https://community.splunk.com/t5/Getting-Data-In/How-to-convert-my-date-and-time-field-into-a-human-readable/m-p/281645#M53856 <P>Something similar to "2-5-2017 10:02 AM" for the example listed above.</P> Tue, 07 Feb 2017 22:21:40 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-convert-my-date-and-time-field-into-a-human-readable/m-p/281645#M53856 aaronevil 2017-02-07T22:21:40Z https://community.splunk.com/t5/Getting-Data-In/How-to-convert-my-date-and-time-field-into-a-human-readable/m-p/281646#M53857 <P>It's already in human-readable format, but if you want to change the format try this:</P> <PRE><CODE>... | fieldformat StartTime=strftime(strptime(StartTime,"%Y-%m-%dT%H:%M:%S.%3N%z"), "%m-%d-%Y %H:%M %p") | fieldformat EndTime=strftime(strptime(EndTime,"%Y-%m-%dT%H:%M:%S.%3N%z"), "%m-%d-%Y %H:%M %p") | ... </CODE></PRE> Tue, 07 Feb 2017 22:33:50 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-convert-my-date-and-time-field-into-a-human-readable/m-p/281646#M53857 richgalloway 2017-02-07T22:33:50Z https://community.splunk.com/t5/Getting-Data-In/How-to-convert-my-date-and-time-field-into-a-human-readable/m-p/281647#M53858 <P>This is actually along the lines of what I was trying initially. When I use fieldformat with strf and strp it removes all data from that field when I table it.</P> <P>index="my_index"<BR /> | dedup key<BR /> | search key!=""<BR /> | fieldformat "StartTime"=strftime(strptime("StartTime","%Y-%m-%dT%H:%M:%S.%3N%z"), "%m-%d-%Y %H:%M %p")<BR /> | table key Summary StartTime</P> <P>Results in StartTime being empty within the table.</P> Tue, 07 Feb 2017 22:58:06 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-convert-my-date-and-time-field-into-a-human-readable/m-p/281647#M53858 aaronevil 2017-02-07T22:58:06Z https://community.splunk.com/t5/Getting-Data-In/How-to-convert-my-date-and-time-field-into-a-human-readable/m-p/281648#M53859 <P>Get rid of your quotes</P> <PRE><CODE>|stats count | fields - count | eval StartTime="2017-02-05T10:02:00.000-0800" | fieldformat StartTime=strftime(strptime(StartTime,"%Y-%m-%dT%H:%M:%S.%3N%z"),"%m-%d-%Y %H:%M %p") | table StartTime </CODE></PRE> Wed, 08 Feb 2017 04:19:51 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-convert-my-date-and-time-field-into-a-human-readable/m-p/281648#M53859 splunker1981 2017-02-08T04:19:51Z https://community.splunk.com/t5/Getting-Data-In/How-to-convert-my-date-and-time-field-into-a-human-readable/m-p/281649#M53860 <P>Doh. Always the little things. I appreciate the additional eyes.</P> Wed, 08 Feb 2017 22:50:56 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-convert-my-date-and-time-field-into-a-human-readable/m-p/281649#M53860 aaronevil 2017-02-08T22:50:56Z