Date showing in a str format

[Eva53]

Hello !

I have a date showing in this format (str) : 20240324090045.560961-240

I've been trying to convert it into a readable date format for my dashboards, with no success so far.

Does someone have a solution ? I'm getting nowhere with the splunk docs or other solved problems.

Thanks !

[Eva53]

It works perfectly for the specified date, but how do I do include it in my command if I want your answer to be the format for every StartTime :

eventtype=windows_index_windows eventtype=hostmon_windows host="///" (Name="///*") OR (Name="///*") OR (Name="///*")  StartTime="*"
| table Name, StartTime

Sorry if I'm not clear, English is not my first language 

[ITWhisperer · Accepted solution]

Depending on what you are trying to do with the StartTime, you may need one or both of the evals

eventtype=windows_index_windows eventtype=hostmon_windows host="///" (Name="///*") OR (Name="///*") OR (Name="///*")  StartTime="*"
| table Name, StartTime
``` Parse strptime the StartTime into an epoch time value ```
| eval epochStartTime=strptime(StartTime,"%Y%m%d%H%M%S.%6N%z")
``` Format strftime the epoch time into a string ```
| eval stringStartTime=strftime(epochStartTime,"%F %T.%6N")

[Eva53]

It worked !

Thank you so much I've been struggling with that problem for so long !

Have a wonderful day

[ITWhisperer]

Does this help?

| makeresults
| eval time="20240324090045.560961-240"
| eval _time=strptime(time,"%Y%m%d%H%M%S.%6N%z")
| eval stringtime=strftime(_time,"%F %T.%6N")