https://community.splunk.com/t5/Splunk-Search/How-to-convert-date-to-epoch/m-p/658253#M227383 <P>I have this date string example:&nbsp;<A href="https://splunk.sec.wixprod.net/en-US/app/SplunkEnterpriseSecuritySuite/search?q=search%20index%3Daxonius%20%20source%3Doracleleavingemp%20%0A%7C%20rename%20%22json_adapter.json_TERMINATION_DATE%22%20as%20termination_date%0A%7C%20eval%20dateadded_epoch%20%3D%20strptime(termination_date%2C%22%25m%2F%25d%2F%25Y%20%25H%3A%25M%22)%20%7C%20eval%20today%20%3D%20relative_time(now()%2C%22-0d%40d%22)%20%0A%7C%20rename%20%22active_directory_adapter.username%22%20as%20ad_user%20json_adapter.json_ASSIGNMENT_TYPE%20as%20type%20%7C%20search%20ad_user!%3Dnull&amp;display.page.search.mode=verbose&amp;dispatch.sample_ratio=1&amp;workload_pool=&amp;earliest=-24h%40h&amp;latest=now&amp;display.general.type=events&amp;display.page.search.tab=events&amp;display.prefs.fieldFilter=date&amp;display.events.fields=%5B%22host%22%2C%22source%22%2C%22sourcetype%22%2C%22DomainName%22%2C%22data.protoPayload.requestMetadata.callerSuppliedUserAgent%22%2C%22user%22%2C%22UserName%22%2C%22UserSid%22%2C%22ComputerName%22%2C%22id%22%2C%22aip%22%2C%22MD5HashData%22%2C%22src_user%22%2C%22siteOwnerId%22%2C%22tag%22%2C%22tag%3A%3Aeventtype%22%2C%22eventtype%22%2C%22startLoadTime%22%2C%22funcName%22%2C%22policy_name%22%2C%22Size%22%2C%22dest_user%22%2C%22dest_ip%22%2C%22github_user%22%2C%22src%22%2C%22records_affected_mean%22%2C%22userIdentity%22%2C%22domain%22%2C%22alert.metadata.domain%22%2C%22aws_account_id%22%2C%22eventName%22%2C%22is_wix_public%22%2C%22service.additionalInfo.profiledBehavior.frequentProfiledAPIsAccountProfiling%22%2C%22service.additionalInfo.profiledBehavior.rareProfiledBucketsAccountProfiling%22%2C%22EventCode%22%2C%22TargetDomainName%22%2C%22event_simpleName%22%2C%22src_agg_field%22%2C%22data.resource.labels.project_id%22%2C%22data.protoPayload.serviceName%22%2C%22signature%22%2C%22src_ip%22%2C%22name%22%2C%22clientId%22%2C%22wix_service%22%2C%22host_ip%22%2C%22node_ip%22%2C%22slack%22%2C%22pod_name%22%2C%22namespace%22%2C%22service%22%2C%22project%22%2C%22cluster%22%2C%22dest_port%22%2C%22index%22%2C%22CommandLine%22%2C%22EnvironmentVariablesString%22%2C%22timestamp%22%2C%22ProcessStartTime%22%2C%22image_by_model%22%2C%22image_name%22%2C%22container_name%22%2C%22database_name%22%2C%22instance_id%22%2C%22records_affected%22%2C%22session_id%22%2C%22session_start%22%2C%22value%22%2C%22field%22%2C%22message%22%2C%22method%22%2C%22cmdline_lookup%22%2C%22cmdline%22%2C%22userAgent%22%2C%22asn%22%2C%22query_type%22%2C%22container_id%22%2C%22rule%22%2C%22mapping%7B%7D%22%2C%22mapping%22%2C%22message_link%22%2C%22message_host_link%22%2C%22source_program%22%2C%22category%22%2C%22aws_account_name%22%2C%22process_kprobe.process.arguments%22%2C%22command%7B%7D%22%2C%22flow.IP.source%22%2C%22flow.IP.destination%22%2C%22process_kprobe.args%7B%7D.sock_arg.saddr%22%2C%22message.process_kprobe.args%7B%7D.sock_arg.saddr%22%2C%22created%22%2C%22org%22%2C%22dest_zone%22%2C%22src_port%22%2C%22ip%22%2C%22dest%22%2C%22ipAddress%22%2C%22user_arn%22%2C%22responseElements.build.phases%7B%7D.phaseStatus%22%2C%22most_events%22%2C%22action%22%2C%22termination_date%22%5D&amp;sid=1695289438.98214_18064EE4-B0B1-4822-AEFC-09D57A493CD7#" target="_blank" rel="noopener">Mon, 01 May 2023 00:00:00 GMT</A></P> <P>how can I convert it to&nbsp;<SPAN>epoch</SPAN>?&nbsp;</P> <P>&nbsp;</P> <P>thanks!</P> Fri, 22 Sep 2023 18:18:48 GMT Shakira1 2023-09-22T18:18:48Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-date-to-epoch/m-p/658253#M227383 <P>I have this date string example:&nbsp;<A href="https://splunk.sec.wixprod.net/en-US/app/SplunkEnterpriseSecuritySuite/search?q=search%20index%3Daxonius%20%20source%3Doracleleavingemp%20%0A%7C%20rename%20%22json_adapter.json_TERMINATION_DATE%22%20as%20termination_date%0A%7C%20eval%20dateadded_epoch%20%3D%20strptime(termination_date%2C%22%25m%2F%25d%2F%25Y%20%25H%3A%25M%22)%20%7C%20eval%20today%20%3D%20relative_time(now()%2C%22-0d%40d%22)%20%0A%7C%20rename%20%22active_directory_adapter.username%22%20as%20ad_user%20json_adapter.json_ASSIGNMENT_TYPE%20as%20type%20%7C%20search%20ad_user!%3Dnull&amp;display.page.search.mode=verbose&amp;dispatch.sample_ratio=1&amp;workload_pool=&amp;earliest=-24h%40h&amp;latest=now&amp;display.general.type=events&amp;display.page.search.tab=events&amp;display.prefs.fieldFilter=date&amp;display.events.fields=%5B%22host%22%2C%22source%22%2C%22sourcetype%22%2C%22DomainName%22%2C%22data.protoPayload.requestMetadata.callerSuppliedUserAgent%22%2C%22user%22%2C%22UserName%22%2C%22UserSid%22%2C%22ComputerName%22%2C%22id%22%2C%22aip%22%2C%22MD5HashData%22%2C%22src_user%22%2C%22siteOwnerId%22%2C%22tag%22%2C%22tag%3A%3Aeventtype%22%2C%22eventtype%22%2C%22startLoadTime%22%2C%22funcName%22%2C%22policy_name%22%2C%22Size%22%2C%22dest_user%22%2C%22dest_ip%22%2C%22github_user%22%2C%22src%22%2C%22records_affected_mean%22%2C%22userIdentity%22%2C%22domain%22%2C%22alert.metadata.domain%22%2C%22aws_account_id%22%2C%22eventName%22%2C%22is_wix_public%22%2C%22service.additionalInfo.profiledBehavior.frequentProfiledAPIsAccountProfiling%22%2C%22service.additionalInfo.profiledBehavior.rareProfiledBucketsAccountProfiling%22%2C%22EventCode%22%2C%22TargetDomainName%22%2C%22event_simpleName%22%2C%22src_agg_field%22%2C%22data.resource.labels.project_id%22%2C%22data.protoPayload.serviceName%22%2C%22signature%22%2C%22src_ip%22%2C%22name%22%2C%22clientId%22%2C%22wix_service%22%2C%22host_ip%22%2C%22node_ip%22%2C%22slack%22%2C%22pod_name%22%2C%22namespace%22%2C%22service%22%2C%22project%22%2C%22cluster%22%2C%22dest_port%22%2C%22index%22%2C%22CommandLine%22%2C%22EnvironmentVariablesString%22%2C%22timestamp%22%2C%22ProcessStartTime%22%2C%22image_by_model%22%2C%22image_name%22%2C%22container_name%22%2C%22database_name%22%2C%22instance_id%22%2C%22records_affected%22%2C%22session_id%22%2C%22session_start%22%2C%22value%22%2C%22field%22%2C%22message%22%2C%22method%22%2C%22cmdline_lookup%22%2C%22cmdline%22%2C%22userAgent%22%2C%22asn%22%2C%22query_type%22%2C%22container_id%22%2C%22rule%22%2C%22mapping%7B%7D%22%2C%22mapping%22%2C%22message_link%22%2C%22message_host_link%22%2C%22source_program%22%2C%22category%22%2C%22aws_account_name%22%2C%22process_kprobe.process.arguments%22%2C%22command%7B%7D%22%2C%22flow.IP.source%22%2C%22flow.IP.destination%22%2C%22process_kprobe.args%7B%7D.sock_arg.saddr%22%2C%22message.process_kprobe.args%7B%7D.sock_arg.saddr%22%2C%22created%22%2C%22org%22%2C%22dest_zone%22%2C%22src_port%22%2C%22ip%22%2C%22dest%22%2C%22ipAddress%22%2C%22user_arn%22%2C%22responseElements.build.phases%7B%7D.phaseStatus%22%2C%22most_events%22%2C%22action%22%2C%22termination_date%22%5D&amp;sid=1695289438.98214_18064EE4-B0B1-4822-AEFC-09D57A493CD7#" target="_blank" rel="noopener">Mon, 01 May 2023 00:00:00 GMT</A></P> <P>how can I convert it to&nbsp;<SPAN>epoch</SPAN>?&nbsp;</P> <P>&nbsp;</P> <P>thanks!</P> Fri, 22 Sep 2023 18:18:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-date-to-epoch/m-p/658253#M227383 Shakira1 2023-09-22T18:18:48Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-date-to-epoch/m-p/658254#M227384 <P>strptime() will convert strings to epoch times</P><LI-CODE lang="markup">| eval _time=strptime(time,"%a, %d %b %Y %H:%M:%S %Z")</LI-CODE> Thu, 21 Sep 2023 10:11:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-date-to-epoch/m-p/658254#M227384 ITWhisperer 2023-09-21T10:11:18Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-date-to-epoch/m-p/658255#M227385 <P>thank you, its working!</P> Thu, 21 Sep 2023 10:12:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-date-to-epoch/m-p/658255#M227385 Shakira1 2023-09-21T10:12:14Z