Convert Time with T and Z to Normal format

Ricco19 · ‎04-09-2024

I have a timestamp with this format

"2024-01-01T20:00:00.190000000Z"

I can convert this to normal format using rex, however, I want to know is there a alternative to convert to normal time format?

richgalloway · ‎04-09-2024

There are many formats that someone would consider "normal". Almost none of them require rex. Use the strptime and strftime functions to convert one time format to another.

| eval ts = strftime(strptime(ts, "%Y-%m-%dT%H:%M:%S.%9N%Z"), "<<your 'normal' format>>")

---
If this reply helps you, Karma would be appreciated.

Convert Time with T and Z to Normal format

splunk-assist

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation

Convert Time with T and Z to Normal format

splunk-assist

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...