Solved: Re: Time formatting from a single field - Splunk Community

Getting Data In

I have a field where time format in: 20020523135537Z which is 05/23/2002 13:53:37 GMT . How can I convert to human readable form in the results ?

1 Solution

Solution

Here's one way.

... | eval timestr = strftime(strptime(field, "%Y%m%d%H%M%S%Z"), "%m/%d/%Y %H:%M:%S %Z") | ...

---
If this reply helps you, Karma would be appreciated.

View solution in original post

Solution

Here's one way.

... | eval timestr = strftime(strptime(field, "%Y%m%d%H%M%S%Z"), "%m/%d/%Y %H:%M:%S %Z") | ...

---
If this reply helps you, Karma would be appreciated.

Thank you. Works perfect.

Get Updates on the Splunk Community!

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner Watch on demand us for a demo-driven ...

The Data Connection - October 2026

We all have data. Lots of it. But that’s not the problem – it’s understanding what we should we do with it, ...

Beyond the Acceleration Zone: Maximizing Your Success with Splunk Customer Experience ...

Customer success is built on tailored guidance and accessible resources. As a Splunk user, you are encouraged ...