https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-time-format-with-strptime/m-p/521917#M147150 <P>Hi</P><P>here is described those parameters.&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Commontimeformatvariables" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Commontimeformatvariables</A><BR />Based on your example you should try this&nbsp;</P><P>eval pTime = strptime (timeField, “%a %b %d %H:%M:%S %Z %Y”)</P><P>You must take care of GMT also as it tells time zone, even it’s meaning UTC.</P><P>r. Ismo</P> Tue, 29 Sep 2020 04:43:12 GMT isoutamo 2020-09-29T04:43:12Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-time-format-with-strptime/m-p/521912#M147148 <P>I haven't found something for this time format in the docs:</P><P>Mon Sep 28 00:00:00 GMT 2020</P><P>How can I convert this with strptime()? How do I make sure the "GMT" part of the string isn't interfering?</P> Tue, 29 Sep 2020 02:58:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-time-format-with-strptime/m-p/521912#M147148 Sundried 2020-09-29T02:58:41Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-time-format-with-strptime/m-p/521917#M147150 <P>Hi</P><P>here is described those parameters.&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Commontimeformatvariables" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Commontimeformatvariables</A><BR />Based on your example you should try this&nbsp;</P><P>eval pTime = strptime (timeField, “%a %b %d %H:%M:%S %Z %Y”)</P><P>You must take care of GMT also as it tells time zone, even it’s meaning UTC.</P><P>r. Ismo</P> Tue, 29 Sep 2020 04:43:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-time-format-with-strptime/m-p/521917#M147150 isoutamo 2020-09-29T04:43:12Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-time-format-with-strptime/m-p/521919#M147152 <P>Depends on what you mean by interfering, but this will parse the date into GMT</P><LI-CODE lang="markup">| makeresults | eval _time=strptime("Mon Sep 28 00:00:00 GMT 2020", "%a %b %d %T %Z %Y")</LI-CODE><P>and this will parse the date to your local time</P><LI-CODE lang="markup">| makeresults | eval _time=strptime("Mon Sep 28 00:00:00 GMT 2020", "%a %b %d %T GMT %Y")</LI-CODE><P>&nbsp;Hope this what you're after</P><P>&nbsp;</P> Tue, 29 Sep 2020 04:45:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-time-format-with-strptime/m-p/521919#M147152 bowesmana 2020-09-29T04:45:39Z