Hi ,
How to convert 2025-03-13T11:03:38Z to the "%d/%m/%Y %I:%M:%S ".
I have tried this, but it didn't work.
| eval Lastevent=strftime(last_seen, "%d/%m/%Y %I:%M:%S %p")
Hi @Nraj87
| makeresults count=1
| fields - _time
| eval last_seen="2025-03-13T11:03:38Z"
| eval Lastevent=strftime(strptime(last_seen, "%Y-%m-%dT%H:%M:%SZ"), "%d/%m/%Y %I:%M:%S %p")
The reason your original command didn't work is because:
The strptime function tells Splunk how to read the input date format, similarly to the strftime
If you want to include AM/PM, keep the %p in the output format. If you don't need it, you can remove it - although you may wish to use %H to return 24hour format instead of %I for 12 hour format.
Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards
Will
| makeresults
| eval last_seen = "2025-03-13T11:03:38Z"
| eval Lastevent = strftime(strptime(last_seen, "%Y-%m-%dT%H:%M:%SZ"), "%d/%m/%Y %I:%M:%S %p")
Is last_seen a string? If so, try parsing it to convert it to an epoch time before formatting the result back to a different string.
| eval Lastevent=strftime(strptime(last_seen, "%FT%T%Z"), "%d/%m/%Y %I:%M:%S %p")