Getting Data In

Question about timestamp formatting

gartnerj
Explorer

I have this is a search:
...
|eval phaseD_time=if(searchmatch("SERVICE_INSTANCE,MESSAGE_RECEIVED,SERVICE_REQUEST"), _time, null())
..
|table phaseD_time

When I get this report, I am getting the TIME value like this:
1393347208.426

How would I get this in some sort of normal format like "mm-dd-YYYY HH:MM:sec"??

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try '... | eval phaseD_timestr=strftime(phaseD_time,"%m-%d-%Y %H:%M:%S" | table phaseD_timestr'. Note that if phaseD_time is null then phaseD_timestr will also be null.

---
If this reply helps you, Karma would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

Glad to hear it. Please accept the answer.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gartnerj
Explorer

Awesome -- thanks.
I actually shortened it to:
eval phaseB_time=strftime(if(searchmatch("LOAD_BALANCER,MESSAGE_RECEIVED,SERVICE_REQUEST"), _time, null()), "%m-%d-%Y %k:%M:%S.%N")

and it does work.

Thanks!!!

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...