topic What is strptime format for 2017-08-01T11:48:15.000+0000 in Splunk Search

What is strptime format for 2017-08-01T11:48:15.000+0000

balamurali_dece — Wed, 09 Aug 2017 11:50:25 GMT

I want to load a json into splunk. The time stamp of each event is in the format 2017-08-01T11:48:15.000+0000. I used %Y-%m-%dT%H:%M:%S.%3N+%z and similar combinations so that splunk recognises the time stamp but with no success. What is correct strptime format so that splunk understands this.

Re: What is strptime format for 2017-08-01T11:48:15.000+0000

adonio — Wed, 09 Aug 2017 13:12:33 GMT

looks like it works fine:
try it:

  | makeresults count=1 
 | eval t = "2017-08-01T11:48:15.000+0100, 2017-08-01T12:48:15.000+0200, 2017-08-01T13:48:15.000+0300"
 | makemv delim="," t
 | mvexpand t
 | eval time = strptime(t, "%Y-%m-%dT%H:%M:%S.%3N%z")

Re: What is strptime format for 2017-08-01T11:48:15.000+0000

richgalloway — Wed, 09 Aug 2017 13:25:56 GMT

The %z format variable includes the '+' so you don't have to specify it separately. Try %Y-%m-%dT%H:%M:%S.%3N%z.