https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-time-field-with-multiple-formats-to-epoch-at/m-p/201830#M58507 <P>The generalized assumption in this question is that the formats cannot be known in advance or are too many to configure manually. Also that the time fields are not the ones that Splunk turns into _time or that we want to catch them before Splunk applies its own time conversion functions to the field.</P> Mon, 02 Nov 2015 21:13:56 GMT landen99 2015-11-02T21:13:56Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-time-field-with-multiple-formats-to-epoch-at/m-p/201824#M58501 <P>How do I take a time field with multiple human-readable formats and get the epoch time at search-time?</P> Wed, 28 Oct 2015 11:48:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-time-field-with-multiple-formats-to-epoch-at/m-p/201824#M58501 landen99 2015-10-28T11:48:15Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-time-field-with-multiple-formats-to-epoch-at/m-p/201825#M58502 <P>What do you mean by "multiple human-readable formats"? Is the format unknown at search time?</P> Wed, 28 Oct 2015 11:55:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-time-field-with-multiple-formats-to-epoch-at/m-p/201825#M58502 richgalloway 2015-10-28T11:55:49Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-time-field-with-multiple-formats-to-epoch-at/m-p/201826#M58503 <P>Please provide a sample of what your events look like (with the fields of interest highlighted), and what you'd like to see</P> Wed, 28 Oct 2015 15:19:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-time-field-with-multiple-formats-to-epoch-at/m-p/201826#M58503 aholzer 2015-10-28T15:19:54Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-time-field-with-multiple-formats-to-epoch-at/m-p/201827#M58504 <P>If your string formatted time is of the form "2015-10-28 08:52:41", then </P> <PRE><CODE>| eval epochTime=strptime(timeStr, "%Y-%m-%d %H:%M:%S") </CODE></PRE> <P>If you need to convert multiple formats, you'll need multiple eval clauses. </P> <P>docs for all of the functions that eval can use: <A href="http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/CommonEvalFunctions</A></P> <P>You'll also probably find the quick reference guide handy. Note the last page which has all the common timeformat %X values. <BR /> <A href="https://www.splunk.com/web_assets/pdfs/secure/Splunk_Quick_Reference_Guide.pdf">https://www.splunk.com/web_assets/pdfs/secure/Splunk_Quick_Reference_Guide.pdf</A> </P> <P>And at pretty much any splunk event they often hand the reference cards out on 8.5"x11" cardstock.</P> Wed, 28 Oct 2015 16:27:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-time-field-with-multiple-formats-to-epoch-at/m-p/201827#M58504 sideview 2015-10-28T16:27:11Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-time-field-with-multiple-formats-to-epoch-at/m-p/201828#M58505 <P>Splunk really needs a search command to allow users to pass a timestamp through <CODE>$SPLUNK_HOME/etc/system/default/datetime.xml</CODE>. But since that doesn't work you will have to use <CODE>coalesce</CODE>, like this:</P> <PRE><CODE>... | eval epochTime=colesce(strptime(timeStr, "&lt;format 1&gt;"), strptime(timeStr, "&lt;format 2&gt;"), ..., strptime(timeStr, "&lt;format n&gt;")) </CODE></PRE> Thu, 29 Oct 2015 15:25:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-time-field-with-multiple-formats-to-epoch-at/m-p/201828#M58505 woodcock 2015-10-29T15:25:09Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-time-field-with-multiple-formats-to-epoch-at/m-p/201829#M58506 <P>I wasn't sure that coalesce would work with more than two.</P> Mon, 02 Nov 2015 19:28:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-time-field-with-multiple-formats-to-epoch-at/m-p/201829#M58506 landen99 2015-11-02T19:28:02Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-time-field-with-multiple-formats-to-epoch-at/m-p/201830#M58507 <P>The generalized assumption in this question is that the formats cannot be known in advance or are too many to configure manually. Also that the time fields are not the ones that Splunk turns into _time or that we want to catch them before Splunk applies its own time conversion functions to the field.</P> Mon, 02 Nov 2015 21:13:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-time-field-with-multiple-formats-to-epoch-at/m-p/201830#M58507 landen99 2015-11-02T21:13:56Z