Getting Data In

time format for 2017-02-03T05:54:20.022Z

AzmathShaik
Path Finder

Hello My time stamp looks like 2017-02-03T05:54:20.022Z

am trying %Y-%m-%dT%H:%M:%S.3%N%Z but no luck

can any one help me

0 Karma
1 Solution

woodcock
Esteemed Legend

Your have 3%N but you need %3N instead:

TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%Z 

View solution in original post

woodcock
Esteemed Legend

Your have 3%N but you need %3N instead:

TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%Z 

mpreddy
Communicator

Hi Azmath,

What exactly are you looking with this time format?

Below is to query convert your time to epoch:

|stats c|eval urtime="2017-02-03T05:54:20.022Z"|eval desiredtimeepoch=strptime(urtime,"%Y-%m-%dT%H:%M:%S.%3N%Z")|table desiredtimeepoch

If you are looking to format the time you can use this query and do modifications as per your requirement:

|stats c|eval urtime="2017-02-03T05:54:20.022Z"|eval desiredtimeepoch=strptime(urtime,"%Y-%m-%dT%H:%M:%S.%3N%Z")|eval formattedtime=strftime(desiredtimeepoch,"%Y%m%d")|table desiredtimeepoch,formattedtime

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...