Getting Data In

Timestamp to date conversion

nc-mvw
Engager

I struggle with converting a time stamp into a date. In my data EMPTY_DATE looks like this:

2020-08-27 00:00:00.0

 

I have tried the following:

| convert timeformat="%m/%d/%Y" ctime(EMPTY_DATE) AS date

 

...and this:

|eval date=strftime(EMPTY_DATE, "%m/%d/%Y")

 

...and this:
| eval time=strptime(EMPTY_DATE,"%Y%m%dT%H:%M:%S.%Q") | convert timeformat="%d%m%Y" ctime(time) as date |

 

All of the above returns empty columns. I don't know if it's because it doesn't recognize my time stamp or something else?

Labels (2)
0 Karma
1 Solution

rnowitzki
Builder

Hi @nc-mvw,

Using this, you get the time as epoch and assigning the date out of time to the date field:

| eval time=strptime(EMPTY_DATE,"%Y-%m-%d %H:%M:%S.%Q")
| eval date = strftime(time,"%Y-%m-%d")

BR
Ralph






--
Karma and/or Solution tagging appreciated.

View solution in original post

Tags (1)

rnowitzki
Builder

Hi @nc-mvw,

Using this, you get the time as epoch and assigning the date out of time to the date field:

| eval time=strptime(EMPTY_DATE,"%Y-%m-%d %H:%M:%S.%Q")
| eval date = strftime(time,"%Y-%m-%d")

BR
Ralph






--
Karma and/or Solution tagging appreciated.
Tags (1)

ITWhisperer
SplunkTrust
SplunkTrust

You need to use strptime to parse the string to retrieve the time value, providing the format so:

eval time=strptime(EMPTY_DATE,"%Y-%m-%d %H:%M:%S.%Q")

 

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...