https://community.splunk.com/t5/Splunk-Search/Convert-field-representing-time-to-another-time-format/m-p/81039#M20481 <P>perfect, thank you so much!</P> Wed, 03 Apr 2013 15:53:44 GMT cosullivan66 2013-04-03T15:53:44Z https://community.splunk.com/t5/Splunk-Search/Convert-field-representing-time-to-another-time-format/m-p/81037#M20479 <P>Hi Everybody,</P> <P>I have a field in my splunk events that is an XML field representing a videoconference session start time called ns2:sessionStartTime. An example of a field value is 2013-03-31T23:12:58.062-07:00. I want to turn this into a number (possibly Unix epoch time?) so I can perform ns2:sessionEndTime - ns2:sessionStartTime and figure out how long the session took. If there's any easier way of doing this calculation I'm all ears. Thanks for any and all help.</P> <P>Conor</P> Mon, 01 Apr 2013 20:23:50 GMT https://community.splunk.com/t5/Splunk-Search/Convert-field-representing-time-to-another-time-format/m-p/81037#M20479 cosullivan66 2013-04-01T20:23:50Z https://community.splunk.com/t5/Splunk-Search/Convert-field-representing-time-to-another-time-format/m-p/81038#M20480 <P>You're probably looking for this:</P> <PRE><CODE>... | eval sessionStartTimeEpoch = strptime(sessionStartTime, "%FT%T.%3N%z") </CODE></PRE> Mon, 01 Apr 2013 20:41:28 GMT https://community.splunk.com/t5/Splunk-Search/Convert-field-representing-time-to-another-time-format/m-p/81038#M20480 martin_mueller 2013-04-01T20:41:28Z https://community.splunk.com/t5/Splunk-Search/Convert-field-representing-time-to-another-time-format/m-p/81039#M20481 <P>perfect, thank you so much!</P> Wed, 03 Apr 2013 15:53:44 GMT https://community.splunk.com/t5/Splunk-Search/Convert-field-representing-time-to-another-time-format/m-p/81039#M20481 cosullivan66 2013-04-03T15:53:44Z