https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-string-to-a-date/m-p/259249#M77709 <P>Try this:</P> <PRE><CODE>| stats count | fields - count | eval timestamp = "2016-05-20T05:16:02.007+02:00" | eval timestamp_epoch = strptime(timestamp, "%Y-%m-%dT%H:%M:%S.%3N%z") </CODE></PRE> Fri, 20 May 2016 08:58:46 GMT javiergn 2016-05-20T08:58:46Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-string-to-a-date/m-p/259248#M77708 <P>I'm trying to convert a string to a date.</P> <P>The string looks like <CODE>2016-05-20T05:16:02.007+02:00</CODE></P> Fri, 20 May 2016 08:39:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-string-to-a-date/m-p/259248#M77708 nicocin 2016-05-20T08:39:23Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-string-to-a-date/m-p/259249#M77709 <P>Try this:</P> <PRE><CODE>| stats count | fields - count | eval timestamp = "2016-05-20T05:16:02.007+02:00" | eval timestamp_epoch = strptime(timestamp, "%Y-%m-%dT%H:%M:%S.%3N%z") </CODE></PRE> Fri, 20 May 2016 08:58:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-string-to-a-date/m-p/259249#M77709 javiergn 2016-05-20T08:58:46Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-string-to-a-date/m-p/259250#M77710 <P>Hmm I get something like this "1463714162.007000"</P> Fri, 20 May 2016 09:06:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-string-to-a-date/m-p/259250#M77710 nicocin 2016-05-20T09:06:58Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-string-to-a-date/m-p/259251#M77711 <P>Yes, that's epoch time and that's what Splunk uses internally to represent dates and times.</P> <P><A href="http://www.epochconverter.com">http://www.epochconverter.com</A><BR /> <A href="https://en.wikipedia.org/wiki/Unix_time">https://en.wikipedia.org/wiki/Unix_time</A></P> <P>What were you planning to do with that timestamp after that?<BR /> Now that it's in the right format you can use strftime and plenty or other functions to work with it. For example:</P> <PRE><CODE>| eval date = strftime(timestamp_epoch, "%Y-%m-%d") </CODE></PRE> Fri, 20 May 2016 09:18:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-string-to-a-date/m-p/259251#M77711 javiergn 2016-05-20T09:18:20Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-string-to-a-date/m-p/259252#M77712 <P>Ahh ok, working great like this.</P> <P>Thank you!</P> Fri, 20 May 2016 09:22:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-string-to-a-date/m-p/259252#M77712 nicocin 2016-05-20T09:22:29Z