Solved: Time formatting from a single field - Splunk Community

Getting Data In

I have a field where time format in: 20020523135537Z which is 05/23/2002 13:53:37 GMT . How can I convert to human readable form in the results ?

1 Solution

Solution

Here's one way.

... | eval timestr = strftime(strptime(field, "%Y%m%d%H%M%S%Z"), "%m/%d/%Y %H:%M:%S %Z") | ...

---
If this reply helps you, Karma would be appreciated.

View solution in original post

Solution

Here's one way.

... | eval timestr = strftime(strptime(field, "%Y%m%d%H%M%S%Z"), "%m/%d/%Y %H:%M:%S %Z") | ...

---
If this reply helps you, Karma would be appreciated.

Thank you. Works perfect.

Get Updates on the Splunk Community!

Casting Call: Compete in Cyber Games

Lights, Camera, SecOps: Apply to Compete in Cyber Games Think you have what it takes to beat the clock? ...

Data Management Digest – June 2026

Welcome to the June 2026 edition of Data Management Digest! This month’s update is short and sweet, with a ...

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them. As ...