Getting Data In

time format for 2017-02-03T05:54:20.022Z

AzmathShaik
Path Finder

Hello My time stamp looks like 2017-02-03T05:54:20.022Z

am trying %Y-%m-%dT%H:%M:%S.3%N%Z but no luck

can any one help me

0 Karma
1 Solution

woodcock
Esteemed Legend

Your have 3%N but you need %3N instead:

TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%Z 

View solution in original post

woodcock
Esteemed Legend

Your have 3%N but you need %3N instead:

TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%Z 

mpreddy
Communicator

Hi Azmath,

What exactly are you looking with this time format?

Below is to query convert your time to epoch:

|stats c|eval urtime="2017-02-03T05:54:20.022Z"|eval desiredtimeepoch=strptime(urtime,"%Y-%m-%dT%H:%M:%S.%3N%Z")|table desiredtimeepoch

If you are looking to format the time you can use this query and do modifications as per your requirement:

|stats c|eval urtime="2017-02-03T05:54:20.022Z"|eval desiredtimeepoch=strptime(urtime,"%Y-%m-%dT%H:%M:%S.%3N%Z")|eval formattedtime=strftime(desiredtimeepoch,"%Y%m%d")|table desiredtimeepoch,formattedtime

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...