Archive
Highlighted

timeformat for AM/PM in MKTime

Communicator

What is the timeformat symbol to specify that AM/PM is included in the string? %P appears to work, but results show a difference when the 2 times are exactly the same. PM is simply being stripped instead of adding 12 hours.

source="WinEventLog:*" |eval time=_time|convert timeformat="%m/%d/%Y %H:%M:%S %P" MkTime(WinEventDate) as wtime|eval diff=wtime-time |where diff<0 |Convert ctime(time) as ctime |fields host, diff, WinEventDate, ctime, time, wtime

Thanks

Tags (1)
0 Karma
Highlighted

Re: timeformat for AM/PM in MKTime

Champion

Open Group's publication says %p (not sure if lower case matters).

http://www.opengroup.org/onlinepubs/009695399/functions/strptime.html

%p    The locale's equivalent of a.m or p.m.

Can you post an example event that you are having problems with?

Highlighted

Re: timeformat for AM/PM in MKTime

Communicator

Example:

10/18/10 08:08:30 PM

0 Karma
Highlighted

Re: timeformat for AM/PM in MKTime

Communicator

Good reference. Thought it might be that I was using an upper case H, but tried all variations of UC and LC H with any parameter related to a 12 hour clock. UC H and UC or LC p are the only ones that returned any result, and they always ignore PM.

0 Karma
Highlighted

Re: timeformat for AM/PM in MKTime

Engager

This syntax works on my Splunk ver. 4.2.2 and converts 24 to 12 hours using %I instead of %H

%Y-%m-%d %I:%M%P

example

2012-02-01 05:47pm

Highlighted

Re: timeformat for AM/PM in MKTime

Path Finder

Here is a Splunk Reference Guide: http://docs.splunk.com/images/1/17/4.2.x_search_language_refcard.pdf

This has a number of wonderfully useful things, the past page devoted to REGEX and Splunk STRPTIME formats.

Highlighted

Re: timeformat for AM/PM in MKTime

Explorer

Any answer on this? I am having the same issue with 5:18:30 PM showing as 05:18:30 with the following search:

eval time=strftime(round(strptime(full_Time, "%H:%M:%S %p")), "%H:%M:%S")

0 Karma
Highlighted

Re: timeformat for AM/PM in MKTime

Explorer

%I designates the hour for 12-hr timing format and %H designates the hour for 24-hr timing format. %P needs to be at the end to pick up the am/pm string at the end.

If using a 12-HR time format, 08:08:30 PM would be:

"%I:%M:%S %P"

If using a 24-HR time format, 20:08:30 PM would be:

"%H:%M:%S %P"

0 Karma
Highlighted

Re: timeformat for AM/PM in MKTime

New Member

When the filed type is string with AM/PM Format

This Solution work for me :
strftime(strptime(replace(FirstDepositDate,substr(FirstDepositDate,-2),""),"%m/%d/%Y"),"%m/%d/%Y"),

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.