topic Re: TIme Conversion in Splunk Search

TIme Conversion

krvamsireddy — Fri, 11 Sep 2020 07:26:13 GMT

Hi ,

how to change the below raw time field to yyyy-mm-dd hh:mm:ss

2020-09-09T18:21:12.2685607Z

am using the below query and didnt get any result

eval time = strftime(activityDateTime,"%Y-%m-%d %H:%M:%S")

Can someone please help

Re: TIme Conversion

ITWhisperer — Fri, 11 Sep 2020 08:06:13 GMT

What do you mean by raw time field? What fields do you have? Do you get anything in the time field you created?

Re: TIme Conversion

thambisetty — Fri, 11 Sep 2020 08:38:50 GMT

strftime is used to convert unix timestamp to human readable format.

you should use strptime to convert time which is already in human readable format if you need to format it.

| makeresults | eval activityDateTime="2020-09-09T18:21:12.2685607Z" | eval time = strftime(strptime(activityDateTime,"%Y-%m-%dT%H:%M:%S"),"%Y-%m-%d %H:%M:%S")

Re: TIme Conversion

krvamsireddy — Fri, 11 Sep 2020 08:27:14 GMT

still in the old format, and time column is still blank

Re: TIme Conversion

krvamsireddy — Fri, 11 Sep 2020 08:29:07 GMT

No i didnt get anything.

raw time field - time format which i get in the event

activityDateTIme

Re: TIme Conversion

ITWhisperer — Fri, 11 Sep 2020 08:41:17 GMT

Looks like you need to parse the activityDateTime with strptime and then format that with strftime

eval time = strptime(strptime(activityDateTime, "%Y-%m-%dT%H:%M:%S.%Q"),"%Y-%m-%d %H:%M:%S")

Or you could just parse the activityDateTime string into an epoch time and the use fieldformat on the time field for display purposes

Re: TIme Conversion

thambisetty — Fri, 11 Sep 2020 08:39:21 GMT

@krvamsireddy

check updated answer.