Getting Data In

Timestamp format with leading hash sign, #Fri Aug 31 14:37:21 2012

jmgilpin
New Member

Any suggestions on the format that I could use to extract this timestamp?

#Fri Aug 31 14:37:21 2012

thanks,

James

0 Karma
1 Solution

vnravikumar
Champion

Hi

Check this

| makeresults 
| eval temp="#Fri Aug 31 14:37:21 2012" 
| eval epoch =strptime(temp,"#%a %b %d %H:%M:%S %Y") 
| eval result = strftime(epoch,"%d/%m/%Y %H:%M:%S")

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Check this

| makeresults 
| eval temp="#Fri Aug 31 14:37:21 2012" 
| eval epoch =strptime(temp,"#%a %b %d %H:%M:%S %Y") 
| eval result = strftime(epoch,"%d/%m/%Y %H:%M:%S")
0 Karma

jmgilpin
New Member

thanks, works great inline

Also, for sourcetype, I used TIME_PREFIX=#

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...