Getting Data In

Timestamp to date conversion

nc-mvw
Engager

I struggle with converting a time stamp into a date. In my data EMPTY_DATE looks like this:

2020-08-27 00:00:00.0

 

I have tried the following:

| convert timeformat="%m/%d/%Y" ctime(EMPTY_DATE) AS date

 

...and this:

|eval date=strftime(EMPTY_DATE, "%m/%d/%Y")

 

...and this:
| eval time=strptime(EMPTY_DATE,"%Y%m%dT%H:%M:%S.%Q") | convert timeformat="%d%m%Y" ctime(time) as date |

 

All of the above returns empty columns. I don't know if it's because it doesn't recognize my time stamp or something else?

Labels (2)
0 Karma
1 Solution

rnowitzki
Builder

Hi @nc-mvw,

Using this, you get the time as epoch and assigning the date out of time to the date field:

| eval time=strptime(EMPTY_DATE,"%Y-%m-%d %H:%M:%S.%Q")
| eval date = strftime(time,"%Y-%m-%d")

BR
Ralph






--
Karma and/or Solution tagging appreciated.

View solution in original post

Tags (1)

rnowitzki
Builder

Hi @nc-mvw,

Using this, you get the time as epoch and assigning the date out of time to the date field:

| eval time=strptime(EMPTY_DATE,"%Y-%m-%d %H:%M:%S.%Q")
| eval date = strftime(time,"%Y-%m-%d")

BR
Ralph






--
Karma and/or Solution tagging appreciated.

View solution in original post

Tags (1)

ITWhisperer
SplunkTrust
SplunkTrust

You need to use strptime to parse the string to retrieve the time value, providing the format so:

eval time=strptime(EMPTY_DATE,"%Y-%m-%d %H:%M:%S.%Q")

 

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!