topic converting lastLogonTimestamp to readable date and time format in Splunk in Splunk Search

converting lastLogonTimestamp to readable date and time format in Splunk

samble — Fri, 11 Sep 2015 20:28:17 GMT

My ldap search for last logon (Active Directory) displays time in a format that makes it harder to read. How can I make the time to be represented as MM-DD-YYYY and XX:XX AM OR PM format? Below is a sample output. Thanks

lastLogonTimestamp: 2015-09-09T19:27:23.641679Z

Re: converting lastLogonTimestamp to readable date and time format in Splunk

somesoni2 — Fri, 11 Sep 2015 20:36:28 GMT

Assuming the lastLogonTimestamp is an extracted field, try this

..your base search | eval lastLogonTimestamp =strftime(strptime(lastLogonTimestamp,"%Y-%m-%dT%H:%M:%S.%QZ"),"%m-%d-%Y %H:%M %p")

Tested by this runanywhere search sample

| gentimes start=-1 |eval lastLogonTimestamp ="2015-09-09T19:27:23.641679Z" | eval lastLogonTimestamp =strftime(strptime(lastLogonTimestamp,"%Y-%m-%dT%H:%M:%S.%QZ"),"%m-%d-%Y %H:%M %p")

Re: converting lastLogonTimestamp to readable date and time format in Splunk

samble — Fri, 11 Sep 2015 21:03:21 GMT

Thanks for the timely response, it worked. The lastlogonTimestamp is an extracted field