Getting Data In

Can you help me with a question about extracting timestamps?

New Member

I have below timestamps in my events

2018-09-14-19.50.21.057230
2018-09-14-19.51.10.675968

I only want to extract hh and mm from them i.e. 19.50 and 19.51

0 Karma
1 Solution

Super Champion

Try this:

|eval Time=strftime(strptime(STATUS_TIME,"%Y-%m-%d-%H.%M.%S.%3N"),"%H.%M")

Try this run anywhere search-

|makeresults|eval STATUS_TIME="2018-09-14-19.50.21.057230"|eval Time=strftime(strptime(STATUS_TIME,"%Y-%m-%d-%H.%M.%S.%3N"),"%H.%M")

View solution in original post

Super Champion

Try this:

|eval Time=strftime(strptime(STATUS_TIME,"%Y-%m-%d-%H.%M.%S.%3N"),"%H.%M")

Try this run anywhere search-

|makeresults|eval STATUS_TIME="2018-09-14-19.50.21.057230"|eval Time=strftime(strptime(STATUS_TIME,"%Y-%m-%d-%H.%M.%S.%3N"),"%H.%M")

View solution in original post

New Member

Thanks a lot..this helps

0 Karma

Splunk Employee
Splunk Employee

Are you trying to use these as the timestamp for the event, or do you simply want to extract the hour and minute into a field?

If the latter, then try:

eval hoursminutes=strftime(yourtimestampfield,"%H.%M")
0 Karma

New Member

There is an extracted field from the events the name for which is STATUS_TIME. I tried using what you gave, it doesn't help

0 Karma