In splunk query i need to convert time format as below .
Current format - Apr 13 17:58:35
Required Format : 04/13/2012 5:58:35 PM
I believe that you'll have to make a two stage operation, first convert your input format to
epoch, and the convert it to your desired format.
... | eval epochtime=strptime(your_current_time_field, "%b %d %H:%M:%S")| eval desired_time=strftime(epochtime, "%d/%m/%Y %I:%M:%S %p")
However, since the data coming in has no year specification, I'm not sure that you would get usable results. It may be that you'll have to make changes to the logging application so that the full date is being logged.
For information regarding
Ah, ziegfried has an important point. If Splunk has read your timestamp (without the year) and parsed and indexed it correctly (you can compare the the timestamps in the events with the timestamp next to the blue down-arrow-thingy to the left of the event), then you can skip the first part and use the
_time field, which is already in
...| eval desired_time=strftime(_time, "%d/%m/%Y %I:%M:%S %p")
Hope this helps somewhat anyway,
Here is how to create a new field by parsing and formatting a date value using Splunk's eval command:
... | eval newdatefield = strftime( strptime( myolddatefield, "%b %d %H:%M:%S" ), "%m/%d/%Y %I:%M:%S %p")
strptime()to parse a timestamp value
strftime()to format a timestamp value