I am converting all statements from my log parser tool to Splunk. I didn't get the exact conversion for date and time timezone format.
Please find my search here from log parser.
TO_LOCALTIME(QUANTIZE(TO_TIMESTAMP(date, time), 1)) as Second, COUNT(*)
I want to convert above statement into Splunk syntax format.
Please help me on this.
Thanks for the reply. I am looking for date format which is " 2015-06-15 00:00:01". something I need to seconds data.
Let me know if you need any info on this.
YOu would need to use strptime funtion like this (run anywhere sample, replace line 1 with your search. Mine just generates dummy row)
| gentimes start=-1 | eval YourDateField="2015-06-15 00:00:01" | table YourDateField | eval YourDateInEpoch=strptime(YourDateField,"%Y-%m-%d %H:%M:%S") | eval YourSecondPart=strftime(YourDateInEpoch,"%S")
Thanks for the quick reply on this. It's really appreciated. what I am doing here is. I am pulling iis log information. I have separate fields which are date and time from my log. first thing is I need to get date and time and same time I need to convert that date into local time.
TOLOCALTIME(QUANTIZE(TOTIMESTAMP(date, time), 1)) as Second
Your help is appreciated.
Could you provide the current value of timestamp that you're getting now and what you want to it to transform into (with actual examples)?
Thanks for the reply. My time format in log file is "2016-01-10 08:00:00 ( Pacific time) and I wanted to convert date and time into Eastern time ( example: 2016-01-10 00:00:00). In above statement I am trying to convert server time to local time.
is this information is good enough?. date and time field are seperate fields here.
One more question is here: shall we use "_time" field to retrieve data?