Splunk Enterprise

How to uniform format for timestamp?

manimuthu
Loves-to-Learn Everything

Hi All,

after querying and grouping my data, my timestamp is of different format like

2021-01-20 07:22:34.545674

2020-02-18T11:03:44.543+0000

2021-01-25T11:05:33.003Z

2022-04-01 19:51:01.411826Z

2021-05-22 02:49:26.607839

How to have a uniform format for all the timestamp values in the stats table 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Where do these timestamps come from? It's a relatively rare situation that you need to use the timestamp from a different part of event than _time field if the event is properly parsed.

I'm not saying it doesn't happen but it's relatively rare.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

It seems like your timestamps are coming as string values in some field (for example my_timestamp) You need to handle each date format and then combine everything with coalesce.

| eval time1=strptime(my_timestamp, "%F %T.%6N")
| eval time2=strptime(my_timestamp, "%FT%T.%3NZ")
....
| eval my_timestamp=coalesce(time1, time2, time3, ....)
| eval my_timestamp=strftime(my_timestamp, "%F %T")

 

See date-time format parameters - https://docs.splunk.com/Documentation/Splunk/8.2.5/SearchReference/Commontimeformatvariables 

0 Karma

manimuthu
Loves-to-Learn Everything

Thanks a lot for all the replies. Actually instead of using timestamps that are coming as string values in some field, i used _time so, that helped me to avoid these different timestamp's formats issue. 

Actually 

| eval my_timestamp=strftime(my_timestamp, "%F %T")

this line helped me a lot . Really thanks for all who took their precious time and efforts to help me  

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

If the answer helped you kindly consider accepting the answer!!!

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...