https://community.splunk.com/t5/Splunk-Search/time-field-extraction/m-p/306688#M92015 <P>How to extract the below data as time field, </P> <PRE><CODE>2016-10-20 INFO ............................................................................ data|15 Feb '17| ............................. 2016-10-20 INFO ............................................................................ data|16 Feb '17| ............................. 2016-10-20 INFO ............................................................................ data|17 Feb '17| ............................. </CODE></PRE> <P>Extracted the _time field but, I need to extract the time field (myfield).... </P> <PRE><CODE>myfield, 15 Feb '17 16 Feb '17 17 Feb '17 </CODE></PRE> <P>How to convert myfield to timestamp ? </P> Thu, 16 Feb 2017 21:15:40 GMT krishnarajb2304 2017-02-16T21:15:40Z https://community.splunk.com/t5/Splunk-Search/time-field-extraction/m-p/306688#M92015 <P>How to extract the below data as time field, </P> <PRE><CODE>2016-10-20 INFO ............................................................................ data|15 Feb '17| ............................. 2016-10-20 INFO ............................................................................ data|16 Feb '17| ............................. 2016-10-20 INFO ............................................................................ data|17 Feb '17| ............................. </CODE></PRE> <P>Extracted the _time field but, I need to extract the time field (myfield).... </P> <PRE><CODE>myfield, 15 Feb '17 16 Feb '17 17 Feb '17 </CODE></PRE> <P>How to convert myfield to timestamp ? </P> Thu, 16 Feb 2017 21:15:40 GMT https://community.splunk.com/t5/Splunk-Search/time-field-extraction/m-p/306688#M92015 krishnarajb2304 2017-02-16T21:15:40Z https://community.splunk.com/t5/Splunk-Search/time-field-extraction/m-p/306689#M92016 <P>myfield is the string, epochvalue will have the epoch time. format will be <CODE>%d %b '%y</CODE></P> <PRE><CODE>your base search, | eval epochvalue=strptime(myfield,"%d %b '%y") </CODE></PRE> <P>Read further on date variables &amp; strptime <A href="https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Commontimeformatvariables">https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Commontimeformatvariables</A></P> <P>Sample:</P> <PRE><CODE>|stats c | eval myfield="15 Feb '17" | eval epochvalue=strptime(myfield,"%d %b '%y") </CODE></PRE> Thu, 16 Feb 2017 21:19:16 GMT https://community.splunk.com/t5/Splunk-Search/time-field-extraction/m-p/306689#M92016 vasanthmss 2017-02-16T21:19:16Z