Getting Data In

Timestamp to date conversion

nc-mvw
Engager

I struggle with converting a time stamp into a date. In my data EMPTY_DATE looks like this:

2020-08-27 00:00:00.0

 

I have tried the following:

| convert timeformat="%m/%d/%Y" ctime(EMPTY_DATE) AS date

 

...and this:

|eval date=strftime(EMPTY_DATE, "%m/%d/%Y")

 

...and this:
| eval time=strptime(EMPTY_DATE,"%Y%m%dT%H:%M:%S.%Q") | convert timeformat="%d%m%Y" ctime(time) as date |

 

All of the above returns empty columns. I don't know if it's because it doesn't recognize my time stamp or something else?

Labels (2)
0 Karma
1 Solution

rnowitzki
Builder

Hi @nc-mvw,

Using this, you get the time as epoch and assigning the date out of time to the date field:

| eval time=strptime(EMPTY_DATE,"%Y-%m-%d %H:%M:%S.%Q")
| eval date = strftime(time,"%Y-%m-%d")

BR
Ralph






--
Karma and/or Solution tagging appreciated.

View solution in original post

Tags (1)

rnowitzki
Builder

Hi @nc-mvw,

Using this, you get the time as epoch and assigning the date out of time to the date field:

| eval time=strptime(EMPTY_DATE,"%Y-%m-%d %H:%M:%S.%Q")
| eval date = strftime(time,"%Y-%m-%d")

BR
Ralph






--
Karma and/or Solution tagging appreciated.
Tags (1)

ITWhisperer
SplunkTrust
SplunkTrust

You need to use strptime to parse the string to retrieve the time value, providing the format so:

eval time=strptime(EMPTY_DATE,"%Y-%m-%d %H:%M:%S.%Q")

 

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...