https://community.splunk.com/t5/Splunk-Search/Date-hour-not-returning-in-24-hour-based-on-AM-PM/m-p/260767#M189658 <P>The query isn't the issue, splunk didn't get the time correct at index.</P> Tue, 02 Feb 2016 14:47:56 GMT TobiasBoone 2016-02-02T14:47:56Z https://community.splunk.com/t5/Splunk-Search/Date-hour-not-returning-in-24-hour-based-on-AM-PM/m-p/260764#M189655 <P>I have an input file that has lines like:<BR /> 2/1/2016,10:21AM,8006529721,4,TOLL-FREE</P> <P>Splunk is accounting for the time correctly in AM/PM however the data_hour values are all being kept in the 12 hour format; so when plotting and selecting for instance out of business hours we don't get good results because we never get an hour value above 12. 1300 to 2400 are lost with the PM. </P> <P>Any ideas how to get hours back to a 24 hour clock?</P> Tue, 02 Feb 2016 14:17:29 GMT https://community.splunk.com/t5/Splunk-Search/Date-hour-not-returning-in-24-hour-based-on-AM-PM/m-p/260764#M189655 TobiasBoone 2016-02-02T14:17:29Z https://community.splunk.com/t5/Splunk-Search/Date-hour-not-returning-in-24-hour-based-on-AM-PM/m-p/260765#M189656 <P>Use eval instead and parse your hour from _time:</P> <PRE><CODE>yoursearch | eval hour = strftime(_time, "%H") | plot using hour </CODE></PRE> Tue, 02 Feb 2016 14:29:27 GMT https://community.splunk.com/t5/Splunk-Search/Date-hour-not-returning-in-24-hour-based-on-AM-PM/m-p/260765#M189656 javiergn 2016-02-02T14:29:27Z https://community.splunk.com/t5/Splunk-Search/Date-hour-not-returning-in-24-hour-based-on-AM-PM/m-p/260766#M189657 <P>Almost the same results here...</P> <P>_time date_hour hour _raw<BR /> 2015-12-31 02:54:00 2 02 12/31/2015,02:54PM,5074576000,1,xyzname</P> <P>I would expect date_hour to come back as 14... the eval above bring back a padded 0 value of the same </P> Tue, 29 Sep 2020 08:37:58 GMT https://community.splunk.com/t5/Splunk-Search/Date-hour-not-returning-in-24-hour-based-on-AM-PM/m-p/260766#M189657 TobiasBoone 2020-09-29T08:37:58Z https://community.splunk.com/t5/Splunk-Search/Date-hour-not-returning-in-24-hour-based-on-AM-PM/m-p/260767#M189658 <P>The query isn't the issue, splunk didn't get the time correct at index.</P> Tue, 02 Feb 2016 14:47:56 GMT https://community.splunk.com/t5/Splunk-Search/Date-hour-not-returning-in-24-hour-based-on-AM-PM/m-p/260767#M189658 TobiasBoone 2016-02-02T14:47:56Z