topic How to convert Day Mon Date HH:mm:ss UTC Year to YYYY-MM-DD HH:MM:SS:Q in Splunk Search

How to convert Day Mon Date HH:mm:ss UTC Year to YYYY-MM-DD HH:MM:SS:Q

gravi — Fri, 22 Nov 2019 16:21:52 GMT

Hi, I have a Timestamp field as Fri Nov 22 03:37:15 UTC 2019 and I want to convert into YYYY-MM-DD HH:MM:SS:6Q format.

Have tried using | eval InputTime=strftime(Timestamp,"%Y-%m-%d %H:%M:%S.%6Q") and it doesn't give me anything

Could you please help?

Thanks.

Re: How to convert Day Mon Date HH:mm:ss UTC Year to YYYY-MM-DD HH:MM:SS:Q

oscar84x — Fri, 22 Nov 2019 16:46:46 GMT

You can try converting it to epoch first then converting it to your desired format:

| makeresults
| eval time ="Fri Nov 22 03:37:15 UTC 2019"
| eval nix= strptime(time , "%a %b %d %H:%M:%S UTC %Y")
| eval newTime=strftime(nix, "%Y-%m-%d %H:%M:%S.%6Q")

Re: How to convert Day Mon Date HH:mm:ss UTC Year to YYYY-MM-DD HH:MM:SS:Q

gravi — Fri, 22 Nov 2019 16:51:07 GMT

Thanks you so much for the answer. I really appreciate it.

And also do you know how to get the difference in datetime fields? Tried eval t=t1-t2 and it gives nothing

Re: How to convert Day Mon Date HH:mm:ss UTC Year to YYYY-MM-DD HH:MM:SS:Q

oscar84x — Fri, 22 Nov 2019 17:05:06 GMT

No problem. Glad to help.
For your other question look at the answer in the link below. Pretty much you'd need to convert your fields to epoch and calculate the difference from that.

https://answers.splunk.com/answers/114818/find-the-difference-between-two-date-time-values.html