topic Converting time in Splunk Search

Converting time

akawacz — Mon, 12 Oct 2015 13:53:27 GMT

How to convert below into readable format ?

41861.003287037
41855.001458333

I was trying this but did not work

strftime(strptime(Close"%m/%e/%Y %l:%M:%S %p"),"%Y-%m-%d %H:%M:%S")

Regards

Re: Converting time

richgalloway — Mon, 12 Oct 2015 14:11:09 GMT

What do those numbers represent? They certainly are not time strings in the format shown in your strptime command.

Re: Converting time

somesoni2 — Mon, 12 Oct 2015 14:31:41 GMT

Try something like this (assuming this is excel date )

strftime((Close-25569)*86400 ,"%Y-%m-%d %H:%M:%S")

Re: Converting time

akawacz — Mon, 12 Oct 2015 15:31:36 GMT

It worked thank you. Could you explain my why we substract 25569 and multiply by 86400

Thank you

Re: Converting time

somesoni2 — Mon, 12 Oct 2015 16:41:09 GMT

The base for excel date time is 1/1/1900 and for epoch is 1/1/1970, the 25569 is the adjustment of dates (for 70 years). Multiplication by 86400 is to convert days into seconds (excel shows in days, epoch in seconds)

Re: Converting time

akawacz — Tue, 13 Oct 2015 09:21:49 GMT

thank you so much