Can you help me with a question about extracting timestamps?

[manijain]

I have below timestamps in my events

2018-09-14-19.50.21.057230
2018-09-14-19.51.10.675968

I only want to extract hh and mm from them i.e. 19.50 and 19.51

[493669 · Accepted solution]

Try this:

|eval Time=strftime(strptime(STATUS_TIME,"%Y-%m-%d-%H.%M.%S.%3N"),"%H.%M")

Try this run anywhere search-

|makeresults|eval STATUS_TIME="2018-09-14-19.50.21.057230"|eval Time=strftime(strptime(STATUS_TIME,"%Y-%m-%d-%H.%M.%S.%3N"),"%H.%M")

[manijain]

Thanks a lot..this helps

[kmorris_splunk]

Are you trying to use these as the timestamp for the event, or do you simply want to extract the hour and minute into a field?

If the latter, then try:

eval hoursminutes=strftime(yourtimestampfield,"%H.%M")

[manijain]

There is an extracted field from the events the name for which is STATUS_TIME. I tried using what you gave, it doesn't help