topic Re: extract a string into readable datetime format in Splunk Search

extract a string into readable datetime format

harshal_chakran — Mon, 20 Jan 2014 12:49:22 GMT

Hi,
I have string in a format as "YYYYMMDD.HHMM" i.e. 20140120.1815

I want to display this in any readable date time format which splunk understands as I have to do further analysis on the basis of time to show it on chart.

Kindly help

Re: extract a string into readable datetime format

richgalloway — Mon, 20 Jan 2014 13:05:32 GMT

eval time=strptime(<time string>,"%Y%m%d.%H%M")

Re: extract a string into readable datetime format

harshal_chakran — Tue, 21 Jan 2014 10:37:47 GMT

Hi,
I have tried it, but couldn't able to get proper result.
My query is as below:

eval newdate="20140120.1815"|eval time=strptime(newdate,"%Y%m%d.%H%M")|table time

it shows output as: 1390221900.000000

Re: extract a string into readable datetime format

lukejadamec — Tue, 21 Jan 2014 13:45:42 GMT

Not sure why the string is not extracted in human readable, but if you use ctime on the created epoch time it should work.
eval newdate="20140120.1815"|eval time=strptime(newdate,"%Y%m%d.%H%M")|convert timeformat="%Y%m%d.%H%M" ctime(time) as Time | table Time

Re: extract a string into readable datetime format

somesoni2 — Tue, 21 Jan 2014 14:19:07 GMT

This should work for you

* | head 1 | eval newdate="20140120.1815"| table newdate|eval time=strptime(newdate,"%Y%m%d.%H%M") | eval Time=strftime(time,"%Y-%m-%d %H:%M:%S.%3Q %p")

Re: extract a string into readable datetime format

jpass — Tue, 21 Jan 2014 18:35:52 GMT

My answer is pretty much the same but you can combine strptime with strftime like this:

| eval newdate="20140120.1815" | eval time=strftime(strptime(newdate,"%Y%m%d.%H%M"),"%Y-%m-%d %T") | table time

output is: 2014-01-20 18:15:00

strptime() - converts your string into a timestamp (epoch or 'seconds since Thursday, 1 January 1970')

strftime() - converts epoch timestamp into the viewable format of your deepest desire

see time variables: http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Commontimeformatvariables

see functions for eval / where: http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/CommonEvalFunctions

Re: extract a string into readable datetime format

harshal_chakran — Thu, 23 Jan 2014 05:52:05 GMT

Thanks somesoni2..
This worked like a charm

Re: extract a string into readable datetime format

arya_alex — Fri, 07 Feb 2014 20:21:50 GMT

Perfect! I had to convert the Date variable of this format Wed Feb 05 UTC 2014 to 2014-02-05.I used the above command like this-
eval time=strptime(Date,"%a %b %d UTC %Y") | eval Time=strftime(time,"%Y-%m-%d")|

Re: extract a string into readable datetime format

marina_rovira — Thu, 18 May 2017 09:51:40 GMT

Hi there!

I cannot make it work, I have this:

 | head 1  | eval my_time="Sun Apr 30 23:46:53 GMT+00:00 2017" | table my_time | eval final=strptime(my_time, "%a %b %d %H:%M:%S %Z%z %Y") | eval Time=strftime(time,"%Y-%m-%d %H:%M:%S") | table my_time,final,Time

I have to fields, StartTime and EndTime and I want to measure the difference between them. But I'm not getting even a timestamp conversion for one field.

Help please!
Thanks

PD: I think I don't have the epoch time neither. So my first problem is there 😞