time format for 2017-02-03T05:54:20.022Z

[AzmathShaik]

Hello My time stamp looks like 2017-02-03T05:54:20.022Z

am trying %Y-%m-%dT%H:%M:%S.3%N%Z but no luck

can any one help me

[woodcock · Accepted solution]

Your have 3%N but you need %3N instead:

TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%Z 

[mpreddy]

Hi Azmath,

What exactly are you looking with this time format?

Below is to query convert your time to epoch:

|stats c|eval urtime="2017-02-03T05:54:20.022Z"|eval desiredtimeepoch=strptime(urtime,"%Y-%m-%dT%H:%M:%S.%3N%Z")|table desiredtimeepoch

If you are looking to format the time you can use this query and do modifications as per your requirement:

|stats c|eval urtime="2017-02-03T05:54:20.022Z"|eval desiredtimeepoch=strptime(urtime,"%Y-%m-%dT%H:%M:%S.%3N%Z")|eval formattedtime=strftime(desiredtimeepoch,"%Y%m%d")|table desiredtimeepoch,formattedtime