Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- How do I convert a timestamp?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I have a field with timestamp value "2017-09-21T20:48:48.535427Z" in format. I need to convert it to "09/21/2017 3:48:48 PM", Please advise?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@kiran331, you would also need to confirm as to what is your Time field name and whether it is epoch timestamp or string timestamp.
If it is string time stamp i.e. the field Time contains string time value as per your given example, then you need to first convert the same to epoch time using strptime() and then use strftime() to convert to the required format.
If the Time field contains epoch time then you would only require strftime() to convert from epoch to string time as per your format. Following is run anywhere search as per your question. PS first two pipes are used to mock up Time field with test value. You can replace the same with your search and time field name accordingly.
| makeresults
| eval Time="2017-09-21T20:48:48.535427Z"
| eval TimeStringConverted=strftime(strptime(Time,"%Y-%m-%dT%H:%M:%S.%6N"),"%m/%d/%Y %H:%M:%S %p")
| table Time TimeStringConverted
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey @kiran331, if they solved your problem, please don't forget to accept an answer! You can upvote posts as well. (Karma points will be awarded for either action.) Happy Splunking!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@kiran331, you would also need to confirm as to what is your Time field name and whether it is epoch timestamp or string timestamp.
If it is string time stamp i.e. the field Time contains string time value as per your given example, then you need to first convert the same to epoch time using strptime() and then use strftime() to convert to the required format.
If the Time field contains epoch time then you would only require strftime() to convert from epoch to string time as per your format. Following is run anywhere search as per your question. PS first two pipes are used to mock up Time field with test value. You can replace the same with your search and time field name accordingly.
| makeresults
| eval Time="2017-09-21T20:48:48.535427Z"
| eval TimeStringConverted=strftime(strptime(Time,"%Y-%m-%dT%H:%M:%S.%6N"),"%m/%d/%Y %H:%M:%S %p")
| table Time TimeStringConverted
| makeresults | eval message= "Happy Splunking!!!"
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Unlocking Unified Insights: New Gigamon Federated Search App for Splunk
GA: New Data Management App in Splunk Platform
Announcing Modern Navigation: A New Era of Splunk User Experience
