Solved: Re: Time formatting from a single field - Splunk Community

Getting Data In

I have a field where time format in: 20020523135537Z which is 05/23/2002 13:53:37 GMT . How can I convert to human readable form in the results ?

1 Solution

Solution

Here's one way.

... | eval timestr = strftime(strptime(field, "%Y%m%d%H%M%S%Z"), "%m/%d/%Y %H:%M:%S %Z") | ...

---
If this reply helps you, Karma would be appreciated.

View solution in original post

Solution

Here's one way.

... | eval timestr = strftime(strptime(field, "%Y%m%d%H%M%S%Z"), "%m/%d/%Y %H:%M:%S %Z") | ...

---
If this reply helps you, Karma would be appreciated.

Thank you. Works perfect.

Get Updates on the Splunk Community!

Event Series: Splunk Observability Metrics Cost Optimization

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...