topic Re: Can you help me convert a time format to a human readable form? in Splunk Search

Can you help me convert a time format to a human readable form?

mbasharat — Mon, 11 Feb 2019 23:21:36 GMT

Hi,

I have the below time format, which I want to convert to a human readable form. A few options would be great.

Thanks in advance.

2019-02-11 10:22:57.533328+00

Re: Can you help me convert a time format to a human readable form?

chrisyounger — Mon, 11 Feb 2019 23:35:11 GMT

Try this:

| eval epoch = strptime("2019-02-11 10:22:57.533328+00", "%Y-%m-%d %H:%M:%S.%6Q%Z")

Then display like so: (you can mix and match)

| eval friendly = strftime(epoch, "%Y-%m-%d") 2017-12-31
| eval friendly = strftime(epoch, "%d %b %y") 3 Feb 17
| eval friendly = strftime(epoch, "%d %B %y") 3 February 2017
| eval friendly = strftime(epoch, "%I:%M:%S %p") 5:45:33 pm
| eval friendly = strftime(epoch, "%H:%M:%S") 17:45:33

Re: Can you help me convert a time format to a human readable form?

mbasharat — Tue, 29 Sep 2020 23:12:29 GMT

Hi Chris,

Here is my sample query and it is not working. The start_date and end_date are in above format and I need them to be readable. Thanks in advance.

index=ABC
| stats dc(profile_name) by profile_name, start_date,end_date
| eval start_date = strptime("start_date", "%Y-%m-%d %H:%M:%S.%6Q%Z")
| table profile_name, start_date, end_date

Re: Can you help me convert a time format to a human readable form?

chrisyounger — Mon, 11 Feb 2019 23:49:14 GMT

Try this:

index=ABC
| stats dc(profile_name) by profile_name, start_date,end_date
| eval start_date = strptime(start_date, "%Y-%m-%d %H:%M:%S.%6Q%Z")
| table profile_name, start_date, end_date

Re: Can you help me convert a time format to a human readable form?

mbasharat — Tue, 29 Sep 2020 23:12:34 GMT

Great!

So I used below:

index=ABC
| stats dc(profile_name) by profile_name, start_date,end_date
| eval start_date = strptime(start_date, "%Y-%m-%d %H:%M:%S.%6Q%Z")
| eval Start_Time = strftime(start_date, "%B %d, %Y at %H:%M:%S")
| table profile_name, Start_Time, end_date

Result is: February 11,2019 at 02:00:04

THANK YOU!!!! 😉

Re: Can you help me convert a time format to a human readable form?

chrisyounger — Tue, 12 Feb 2019 00:02:42 GMT

good stuff