Getting Data In

Question about timestamp formatting

Explorer

I have this is a search:
...
|eval phaseD_time=if(searchmatch("SERVICE_INSTANCE,MESSAGE_RECEIVED,SERVICE_REQUEST"), _time, null())
..
|table phaseD_time

When I get this report, I am getting the TIME value like this:
1393347208.426

How would I get this in some sort of normal format like "mm-dd-YYYY HH:MM:sec"??

Tags (1)
0 Karma

SplunkTrust
SplunkTrust

Try '... | eval phaseD_timestr=strftime(phaseD_time,"%m-%d-%Y %H:%M:%S" | table phaseD_timestr'. Note that if phaseD_time is null then phaseD_timestr will also be null.

---
If this reply helps you, an upvote would be appreciated.

SplunkTrust
SplunkTrust

Glad to hear it. Please accept the answer.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Explorer

Awesome -- thanks.
I actually shortened it to:
eval phaseB_time=strftime(if(searchmatch("LOAD_BALANCER,MESSAGE_RECEIVED,SERVICE_REQUEST"), _time, null()), "%m-%d-%Y %k:%M:%S.%N")

and it does work.

Thanks!!!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!