topic Re: how to convert UTC time into mmddyy format in Splunk Search

how to convert UTC time into mmddyy format

mtidke — Thu, 06 Jun 2024 17:04:18 GMT

Hi,

how to convert UTC time into mmddyy format.

I tried this query for search

| makeresults
| eval time
| eval readable_time = strftime(strptime(tostring(time/1000), "%s"), "%m%d%y")
| table time, readable_time

The time format is time: 1717690912746

Thank you

Re: how to convert UTC time into mmddyy format

deepakc — Thu, 06 Jun 2024 17:30:06 GMT

| makeresults | eval time=1717690912746 | eval readable_time = strftime(time,"%m/%d/%y %H:%M:%S") | table time, readable_time

Re: how to convert UTC time into mmddyy format

antoniolamonica — Thu, 06 Jun 2024 18:48:53 GMT

Unsure what format "time" is in for you.

You could try converting "time" into unix time (assuming it is populating differently from "_time"), and then converting it back into readable_time:

| eval time=(time, "%H:%M") (this may vary on its current format)
| eval readable_time = strftime(_time, "%m/%d/%Y")

be sure not to confuse "time" and "_time"
_time is by default in unix time.

https://docs.splunk.com/Documentation/SCS/current/SearchReference/DateandTimeFunctions

If this helped, karma is appreciated.

Re: how to convert UTC time into mmddyy format

yuanliu — Fri, 07 Jun 2024 05:09:33 GMT

I do not get the question. Except that you need to put that value into eval, the search does give you 060624. Isn't this what you are looking for? What is the question?

| makeresults | eval time=1717690912746 | eval readable_time = strftime(strptime(tostring(time/1000), "%s"), "%m%d%y") | table time, readable_time

This is what I get

time	readable_time
1717690912746	060624

Re: how to convert UTC time into mmddyy format

mtidke — Fri, 07 Jun 2024 11:29:15 GMT

I tried this but got an error

Error in 'EvalCommand': Failed to parse the provided arguments. Usage: eval dest_key = expression.
The search job has failed due to an error. You may be able view the job in the