All Apps and Add-ons

Splunk App for Stream: How do I change the timestamp format and timezone?


As we know,the date seems like this:


I want to change it like this:

15/11/10 11:46:01.031377

Notice that I need to change the timezone to +8.Just tell me how to do it,please..

0 Karma

Splunk Employee
Splunk Employee

hi oraant,

You can try something like this: eval time_var = strptime("%Y-%m-%dT%H:%M:%S.%6N%z", endtime) | convert timeformat="%y/%m/%d %H:%M:%S" ctime(time_var) AS c_time (assuming that you want to convert the endtime field)

0 Karma
Get Updates on the Splunk Community!

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...