Change time format for a workflow action?

[alferone]

Here is a snippet of the URL I am sending and the time format in which it needs to be:

startTime=2023-12-01T16%3A27%3A45.000Z&endTime=2023-12-01T16%3A32%3A45.000Z

However, when I try to send "latesttime" or "earliesttime", splunk is sending it in epoch.

How do I get the proper format of time for the URL within the workflow action?

Thanks!

[glc_slash_it]

Hi,

For Splunk, earliest and latest fields are always in epoch format.

But you can try to format them using strptime(earliest , "%Y-%m-%dT%H:%M:%S").

Docs:

https://docs.splunk.com/Documentation/SCS/current/SearchReference/DateandTimeFunctions#strptime.28.2...

------------
If this was helpful, some karma would be appreciated.

[alferone]

Well, yeah, I understand how I can convert the time from epoch, but I am trying to do this inside of a workflow action.  Someone searches "index=firewall", and then they click on "Event Actions" to click on the workflow action.  How does the time get converted through that mechanism?