I have two fields that are extracted in Splunk i.e.. start time and end time which is in 12 hours formats. I want to convert them to 24 hours format. Can someone help on this ?
here is the data below,
start time : 11/21/2018 11:04:54 AM, End time : 11/21/2018 11:04:56 AM
start time : 2010-04-01,,11/20/2018 6:59:59 PM, End time :11/20/2018 7:03:20 PM
You can use the below commands to convert time to 24hr format
convert timeformat="%Y/%m/%d %I:%M:%S %p" MkTime(start_time) as new_start_time| convert ctime(new_start_time) as start_time