Getting Data In

Convert datetime(in user format) extracted from field to splunk understandable format

adityapavan18
Contributor

I have time logged in as the below format
....
2011-11-18T00:00:00
....

I am able to extract that time using field extraction to get
OrderDate as 2011-11-18T00:00:00

Is there any way to convert that value to format

2011/11/18 00:00:00

The reason for this is i need to find diffrence between times, and i cannot do it if time is in format of 2011-11-18T00:00:00
Please suggest me ideas to implement this.

Tags (1)
0 Karma
1 Solution

Ayn
Legend
... | eval ReformattedOrderDate=strptime(OrderDate,"%Y-%m-%dT%H:%M:%S")

This will return the corresponding epoch value for the timestamp, which should be appropriate to use when comparing times. If you want to use another time, use eval again with strftime.

View solution in original post

Ayn
Legend
... | eval ReformattedOrderDate=strptime(OrderDate,"%Y-%m-%dT%H:%M:%S")

This will return the corresponding epoch value for the timestamp, which should be appropriate to use when comparing times. If you want to use another time, use eval again with strftime.

adityapavan18
Contributor

thanks a lot for the help

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...