Hi,
How to parse below
2020.08.20 07:38:42 902 +1000
Hi
Here is example what you can do with it
| makeresults
| eval Time1="2020.08.20 07:38:42 902 +1000"
| eval epoch_time = strptime(Time1, "%Y.%m.%d %H:%M:%S %3Q %z")
| eval Time_Human = strftime(epoch_time, "%c")
| eval Time_2 = strftime(epoch_time,"%FT%T.%3Q%:z")
More information about time formats:
https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Commontimeformatvariables
r. Ismo
Hi
Here is example what you can do with it
| makeresults
| eval Time1="2020.08.20 07:38:42 902 +1000"
| eval epoch_time = strptime(Time1, "%Y.%m.%d %H:%M:%S %3Q %z")
| eval Time_Human = strftime(epoch_time, "%c")
| eval Time_2 = strftime(epoch_time,"%FT%T.%3Q%:z")
More information about time formats:
https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Commontimeformatvariables
r. Ismo
Please provide more information, where you want to parse that timestamp ?