Knowledge Management

convert extracted time from log to start_time

awedmondson
Explorer

I have extracted an event time as a field from an event as
Nov 27, 2014 9:42

presently I have:
convert timeformat="%m/%d/%Y %H:%M:%S" ctime(_time) AS start_time
But for some reason, splunk occasional reads the event time stamp 8 hours out, so I have extracted Nov 27, 2014 9:42, question is how can I get it as start_time

thanks

Tags (2)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You're looking at "Nov 27,2014" but are parsing "%m/%d/%Y" - those two don't fit together. This works for me:

| stats count | eval event_time = "Nov 27, 2014 9:42" | eval start_time = strptime(event_time, "%b %d, %Y %H:%M") | eval test = strftime(start_time, "%+")

The test field is there to confirm the parsing worked correctly. Note I'm looking for "%b %d, %Y" for the date which matches "Nov 27, 2014".

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...