parsing time

[VijaySrrie]

Hi,

How to parse below

2020.08.20 07:38:42 902 +1000

[isoutamo · Accepted solution]

Hi

Here is example what you can do with it

| makeresults
| eval Time1="2020.08.20 07:38:42 902 +1000"
| eval epoch_time = strptime(Time1, "%Y.%m.%d %H:%M:%S %3Q %z")
| eval Time_Human = strftime(epoch_time, "%c")
| eval Time_2 = strftime(epoch_time,"%FT%T.%3Q%:z")

More information about time formats:

https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Commontimeformatvariables

r. Ismo 

[harsmarvania57]

Please provide more information, where you want to parse that timestamp ?