topic How to convert this string into a usable time format? in Splunk Search

How to convert this string into a usable time format?

jperezes — Fri, 03 Mar 2017 02:41:40 GMT

Hi and thanks in advance,

I am trying to convert the following time example field:

2017-03-02T09:41:38.405Z

into a Splunk time format so I can get time windows to use in streamstats.
thing is with the T in the middle and the Z at the end, all the tries I am doing with strptime are failing.
I tried the following:

|eval time=strptime(timeValue,"%Y-%m-%dT%H:%M:%S.%3QZ")

but no luck, any idea?

Rgds,
Juan

Re: How to convert this string into a usable time format?

woodcock — Fri, 03 Mar 2017 02:54:36 GMT

2017-03-02T09:41:38.405Z

Like this (The trailing Z is for Zulu, AKA GMT so you need to grab the TZ with %Z😞

| eval time=strptime(timeValue,"%Y-%m-%dT%H:%M:%S.%3N%Z")

Re: How to convert this string into a usable time format?

jperezes — Wed, 08 Mar 2017 11:04:23 GMT

Thanks, sorry for late reply but was trying bits and pieces but couldn't get what I wanted; get the streamstats based on next time specifiead in the json data, not the arrival time. So far no luck on all my tries, not sure if is possible. Will post another question.

Thanks anyway.