Getting Data In

Convert datetime(in user format) extracted from field to splunk understandable format

adityapavan18
Contributor

I have time logged in as the below format
....
2011-11-18T00:00:00
....

I am able to extract that time using field extraction to get
OrderDate as 2011-11-18T00:00:00

Is there any way to convert that value to format

2011/11/18 00:00:00

The reason for this is i need to find diffrence between times, and i cannot do it if time is in format of 2011-11-18T00:00:00
Please suggest me ideas to implement this.

Tags (1)
0 Karma
1 Solution

Ayn
Legend
... | eval ReformattedOrderDate=strptime(OrderDate,"%Y-%m-%dT%H:%M:%S")

This will return the corresponding epoch value for the timestamp, which should be appropriate to use when comparing times. If you want to use another time, use eval again with strftime.

View solution in original post

Ayn
Legend
... | eval ReformattedOrderDate=strptime(OrderDate,"%Y-%m-%dT%H:%M:%S")

This will return the corresponding epoch value for the timestamp, which should be appropriate to use when comparing times. If you want to use another time, use eval again with strftime.

adityapavan18
Contributor

thanks a lot for the help

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...