Field will not convert time

jason_hotchkiss — Tue, 02 Feb 2021 16:29:51 GMT

Hello Splunkers,

I have the following field with a date/time stamp: 2021-02-02 15:58:34.0

I am trying to convert it to a format such as: 1612279887.000
Ultimately it is my goal to use it in a calculation.

I'm using the following search:

search | fields status_dt
| table status_dt
| rename status_dt AS "x"
| eval y=strptime(x, "%m/%d/%y %H:%M:%S") | eval z= strftime(y,"%d %b %Y")
| table x y z

But all I get is a table that looks like:

x y z
2021-02-02 15:58:34.0

What am I doing wrong? Thanks in advanced

Re: Field will not convert time

ITWhisperer — Tue, 02 Feb 2021 16:50:47 GMT

Your parse string doesn't match the date format you are using

| eval y=strptime(x, "%Y-%m-%d %H:%M:%S")

Re: Field will not convert time

jason_hotchkiss — Tue, 02 Feb 2021 16:58:29 GMT

Thank you very much!

topic Field will not convert time in Splunk Search

Field will not convert time

Re: Field will not convert time

Re: Field will not convert time