What is the timeformat symbol to specify that AM/PM is included in the string? %P appears to work, but results show a difference when the 2 times are exactly the same. PM is simply being stripped instead of adding 12 hours.
source="WinEventLog:*" |eval time=_time|convert timeformat="%m/%d/%Y %H:%M:%S %P" MkTime(WinEventDate) as wtime|eval diff=wtime-time |where diff<0 |Convert ctime(time) as ctime |fields host, diff, WinEventDate, ctime, time, wtime
Open Group's publication says %p (not sure if lower case matters).
%p The locale's equivalent of a.m or p.m.
Can you post an example event that you are having problems with?
Good reference. Thought it might be that I was using an upper case H, but tried all variations of UC and LC H with any parameter related to a 12 hour clock. UC H and UC or LC p are the only ones that returned any result, and they always ignore PM.
Here is a Splunk Reference Guide: http://docs.splunk.com/images/1/17/4.2.x_search_language_refcard.pdf
This has a number of wonderfully useful things, the past page devoted to REGEX and Splunk STRPTIME formats.
Any answer on this? I am having the same issue with 5:18:30 PM showing as 05:18:30 with the following search:
eval time=strftime(round(strptime(full_Time, "%H:%M:%S %p")), "%H:%M:%S")
%I designates the hour for 12-hr timing format and %H designates the hour for 24-hr timing format. %P needs to be at the end to pick up the am/pm string at the end.
If using a 12-HR time format, 08:08:30 PM would be:
If using a 24-HR time format, 20:08:30 PM would be:
When the filed type is string with AM/PM Format
This Solution work for me :