topic Re: Convert time from AM/PM to 24 Hour format in Splunk Search

Convert time from AM/PM to 24 Hour format

chandra61446 — Tue, 01 Mar 2016 12:31:52 GMT

index=* "please type serach keyword" host=xyz*
| rex field=_raw "^(?:[^ \n]* ){2}(?P\d+:\d+):\d+\s+\w+\s+\w+:\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\d+\s+(?P\d+:\d+)"]
| dedup host
| convert timeformat="%H:%M:%S" ctime(ServerTime) AS ST
| table ServerTime ST DeviceSyncTime

ServerTime shows in AM/PM format and DeviceSyncTime shows in 24 hour format. How do I change the ServerTime field value to the 24 hour format?

Note I don't want to have _time anywhere..

Re: Convert time from AM/PM to 24 Hour format

alemarzu — Tue, 01 Mar 2016 20:39:22 GMT

Hi there chandra, try with this.

| eval time24hs=strftime(ServerTime, "%H:%M:%S")

Hope it helps.

Re: Convert time from AM/PM to 24 Hour format

somesoni2 — Tue, 01 Mar 2016 20:59:59 GMT

Where are you extracting ServerTime field and what is the format of the value (sample logs will be helpful)?

Re: Convert time from AM/PM to 24 Hour format

chandra61446 — Wed, 02 Mar 2016 06:39:48 GMT

Below id raw data

[10A8:0564-151C] 03/01/2016 09:58:22 PM Traveler: The last successful device sync was on Tue Mar 01 21:58:21 EST 2016.

I am picking 09:58 as ServerTime abd 21:58 as DeviceSyncTime

Now like to ServerTime to converted into 24hours format

Re: Convert time from AM/PM to 24 Hour format

chandra61446 — Wed, 02 Mar 2016 06:42:01 GMT

It did not help .. Below id raw data

[10A8:0564-151C] 03/01/2016 09:58:22 PM Traveler: The last successful device sync was on Tue Mar 01 21:58:21 EST 2016.

I am picking 09:58 as ServerTime abd 21:58 as DeviceSyncTime

Now like to ServerTime to converted into 24hours format

Re: Convert time from AM/PM to 24 Hour format

alemarzu — Wed, 02 Mar 2016 12:28:56 GMT

Use _time instead ServerTime, like this.

| eval time24hs=strftime(_time, "%H:%M:%S")

Re: Convert time from AM/PM to 24 Hour format

chandra61446 — Wed, 02 Mar 2016 12:38:41 GMT

This one worked

| eval epochtime=strptime(Dtime, "%H:%M:%S")| eval DSyncTime=strftime(epochtime, "%I:%M:%S")