topic Re: Have problem with my timestamp format in Splunk ITSI

Have problem with my timestamp format

jcvytla — Wed, 04 Apr 2018 19:34:39 GMT

I'm trying to do forecasting on hourly data. I'm getting error , even though I change my time format. need help in converting "3/5/2018 0:49" into unix time stamp.

Re: Have problem with my timestamp format

adonio — Wed, 04 Apr 2018 19:40:44 GMT

try this:

| makeresults count=1 | eval time = "3/5/2018 0:49"
| eval in_epoch = strptime(time, "%m/%d/%Y %H:%M")

hope it helps

Re: Have problem with my timestamp format

jcvytla — Wed, 04 Apr 2018 19:47:03 GMT

Could you please help me with time chart for the same time format?

Thanks in advance

Re: Have problem with my timestamp format

lsnow_splunk — Wed, 04 Apr 2018 19:48:16 GMT

Hi, @jcvytla-

Check out the "convert" command. The syntax for your case would look something like

convert timeformat=%m/%d/%Y %H:%M mktime(existing_time_field) AS epoch_time

but double check the time format if it doesn't seem to be working for you - the lack of leading zeroes in your timestamp might mean that you have to tweak that.

Re: Have problem with my timestamp format

adonio — Wed, 04 Apr 2018 19:50:44 GMT

for timechart youll need to convert your time to the field _time
same thing, and now you can | timechart ... as foo | predict foo