Getting Data In

How do I convert serial date time?

ckumbier
New Member

How do I convert serial date time (1900 Date System)? For example, I would like to convert
41215.10417 to 11/2/12 2:30 AM

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

Converting to unix time worked for me;

... | eval AAA = (your_time_field - 25569) * 86400 | convert ctime(AAA)

where 25569 is the actual number of days between Jan 1 1900, and Jan 1 1970 (according to some online calendar tool - din't count them myself).

Subtract, multiply, convert, ACTION.

/K

View solution in original post

kristian_kolb
Ultra Champion

Converting to unix time worked for me;

... | eval AAA = (your_time_field - 25569) * 86400 | convert ctime(AAA)

where 25569 is the actual number of days between Jan 1 1900, and Jan 1 1970 (according to some online calendar tool - din't count them myself).

Subtract, multiply, convert, ACTION.

/K

ckumbier
New Member

Works for me.

0 Karma

ckumbier
New Member

I would like to do it at index time but doing it at search would be acceptable.

0 Karma

lukejadamec
Super Champion

Where are you trying to do the conversion? In a search, or at index time?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 1 release of new security content via the ...

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...