https://community.splunk.com/t5/Splunk-Search/Convert-TimeFormat/m-p/58493#M14323 <P>I have an event field called `LastBootUpTime=20120119121719.125000-360'</P> <P>I am trying to convert this to a more readable format by using this convert command</P> <PRE><CODE>| convert timeformat="%m-%d-%Y %H:%M:%S" ctime(LastBootUpTime) AS BootTime </CODE></PRE> <P>this is not working. What am I missing??</P> Thu, 26 Jan 2012 18:25:38 GMT hartfoml 2012-01-26T18:25:38Z https://community.splunk.com/t5/Splunk-Search/Convert-TimeFormat/m-p/58493#M14323 <P>I have an event field called `LastBootUpTime=20120119121719.125000-360'</P> <P>I am trying to convert this to a more readable format by using this convert command</P> <PRE><CODE>| convert timeformat="%m-%d-%Y %H:%M:%S" ctime(LastBootUpTime) AS BootTime </CODE></PRE> <P>this is not working. What am I missing??</P> Thu, 26 Jan 2012 18:25:38 GMT https://community.splunk.com/t5/Splunk-Search/Convert-TimeFormat/m-p/58493#M14323 hartfoml 2012-01-26T18:25:38Z https://community.splunk.com/t5/Splunk-Search/Convert-TimeFormat/m-p/58494#M14324 <P>If I'm not wrong, convert needs epoch time for ctime().<BR /> So use strptime to convert to epoch time this first:</P> <PRE><CODE>| eval temp=strptime(LastBootUpTime,"%Y%m%d%H%M%S") | convert timeformat="%m-%d-%Y %H:%M:%S" ctime(temp) AS BootTime </CODE></PRE> <P>This will return BootTime in a human readable format, as specified in the timeformat parameter.</P> Thu, 26 Jan 2012 19:20:44 GMT https://community.splunk.com/t5/Splunk-Search/Convert-TimeFormat/m-p/58494#M14324 bojanz 2012-01-26T19:20:44Z https://community.splunk.com/t5/Splunk-Search/Convert-TimeFormat/m-p/58495#M14325 <P>That was the answer... howd you get so smart <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 26 Jan 2012 19:25:40 GMT https://community.splunk.com/t5/Splunk-Search/Convert-TimeFormat/m-p/58495#M14325 hartfoml 2012-01-26T19:25:40Z