topic Re: Can you help me with a question about extracting timestamps? in Getting Data In

Can you help me with a question about extracting timestamps?

manijain — Wed, 03 Oct 2018 12:36:23 GMT

I have below timestamps in my events

2018-09-14-19.50.21.057230
2018-09-14-19.51.10.675968

I only want to extract hh and mm from them i.e. 19.50 and 19.51

kmorris_splunk — Wed, 03 Oct 2018 12:47:50 GMT

Are you trying to use these as the timestamp for the event, or do you simply want to extract the hour and minute into a field?

If the latter, then try:

eval hoursminutes=strftime(yourtimestampfield,"%H.%M")

manijain — Wed, 03 Oct 2018 13:21:58 GMT

There is an extracted field from the events the name for which is STATUS_TIME. I tried using what you gave, it doesn't help

493669 — Wed, 03 Oct 2018 13:30:10 GMT

Try this:

|eval Time=strftime(strptime(STATUS_TIME,"%Y-%m-%d-%H.%M.%S.%3N"),"%H.%M")

Try this run anywhere search-

|makeresults|eval STATUS_TIME="2018-09-14-19.50.21.057230"|eval Time=strftime(strptime(STATUS_TIME,"%Y-%m-%d-%H.%M.%S.%3N"),"%H.%M")

manijain — Thu, 04 Oct 2018 12:08:52 GMT

Thanks a lot..this helps