Getting Data In

Can you help me with a question about extracting timestamps?

manijain
New Member

I have below timestamps in my events

2018-09-14-19.50.21.057230
2018-09-14-19.51.10.675968

I only want to extract hh and mm from them i.e. 19.50 and 19.51

0 Karma
1 Solution

493669
Super Champion

Try this:

|eval Time=strftime(strptime(STATUS_TIME,"%Y-%m-%d-%H.%M.%S.%3N"),"%H.%M")

Try this run anywhere search-

|makeresults|eval STATUS_TIME="2018-09-14-19.50.21.057230"|eval Time=strftime(strptime(STATUS_TIME,"%Y-%m-%d-%H.%M.%S.%3N"),"%H.%M")

View solution in original post

493669
Super Champion

Try this:

|eval Time=strftime(strptime(STATUS_TIME,"%Y-%m-%d-%H.%M.%S.%3N"),"%H.%M")

Try this run anywhere search-

|makeresults|eval STATUS_TIME="2018-09-14-19.50.21.057230"|eval Time=strftime(strptime(STATUS_TIME,"%Y-%m-%d-%H.%M.%S.%3N"),"%H.%M")

manijain
New Member

Thanks a lot..this helps

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

Are you trying to use these as the timestamp for the event, or do you simply want to extract the hour and minute into a field?

If the latter, then try:

eval hoursminutes=strftime(yourtimestampfield,"%H.%M")
0 Karma

manijain
New Member

There is an extracted field from the events the name for which is STATUS_TIME. I tried using what you gave, it doesn't help

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...