topic How can I convert it to splunk time format? in Splunk Search

How can I convert it to splunk time format?

ajayrathore — Wed, 07 Dec 2022 15:55:03 GMT

Hi,

I have a field in the logs like below

2022-12-07T08:40:14.253180536

How can I convert it to splunk time format?

I need to eventually select this field in the table, so the conversion should work within stats

gcusello — Wed, 07 Dec 2022 12:08:20 GMT

what do you mean with "splunk time format"?

if you mean _time (that's epochtime) you can use the strptime function in the eval command

| eval new_time=strptime(your_time, "%Y-%m-%dT%H:%M:%S.9%N")

if instead you're speaking of the time format when a log is acquired and indexed, you have to put in props.conf for that sourcetype:

TIME_FORMAT = %Y-%m-%dT%H:%M:%S.9%N

Ciao.

Giuseppe