topic Re: Need to remove T and Z from output timestamp in Splunk Search

Need to remove T and Z from output timestamp

ravir_jbp — Wed, 01 Nov 2023 17:01:18 GMT

I am trying to remove T and Z from the output timestamp results. Can you please help me with the query to remove and space in the place of T and Z.

2023-11-01T15:54:00Z

Re: Need to remove T and Z from output timestamp

ITWhisperer — Wed, 01 Nov 2023 17:04:36 GMT

| makeresults | eval time="2023-11-01T15:54:00Z" | eval reformatted=strftime(strptime(time,"%FT%TZ"),"%F %T")

Re: Need to remove T and Z from output timestamp

ravir_jbp — Wed, 01 Nov 2023 17:16:31 GMT

This is the final stats results I got it now. The query you have shared is used to modify specific time. But I like to modify the timestamp on all the below mentioned column.

Re: Need to remove T and Z from output timestamp

ITWhisperer — Wed, 01 Nov 2023 17:22:22 GMT

| eval stime=strftime(strptime(stime,"%FT%TZ"),"%F %T") | eval etime=strftime(strptime(etime,"%FT%TZ"),"%F %T") | eval orgstime=strftime(strptime(orgstime,"%FT%TZ"),"%F %T") | eval orgetime=strftime(strptime(orgetime,"%FT%TZ"),"%F %T")

Re: Need to remove T and Z from output timestamp

yuanliu — Wed, 01 Nov 2023 19:28:20 GMT

As I noted in https://community.splunk.com/t5/Splunk-Search/Date-time-formatting-variables-not-producing-result-I-expected/m-p/666477#M228639, the letter "Z" signifies a standard time zone and you should NOT simply remove it. Instead, Splunk should process it as a timezone token before you render the end result in any string format you wanted. In other words,

| eval stime=strftime(strptime(stime,"%FT%T%Z"),"%F %T") | eval etime=strftime(strptime(etime,"%FT%T%Z"),"%F %T") | eval orgstime=strftime(strptime(orgstime,"%FT%T%Z"),"%F %T") | eval orgetime=strftime(strptime(orgetime,"%FT%T%Z"),"%F %T")