Have problem with my timestamp format

[jcvytla]

I'm trying to do forecasting on hourly data. I'm getting error , even though I change my time format. need help in converting "3/5/2018 0:49" into unix time stamp.

[lsnow_splunk]

Hi, @jcvytla-

Check out the "convert" command. The syntax for your case would look something like

convert timeformat=%m/%d/%Y %H:%M mktime(existing_time_field) AS epoch_time

but double check the time format if it doesn't seem to be working for you - the lack of leading zeroes in your timestamp might mean that you have to tweak that.

[adonio · Accepted solution]

try this:

| makeresults count=1 | eval time = "3/5/2018 0:49"
| eval in_epoch = strptime(time, "%m/%d/%Y %H:%M")

hope it helps

[jcvytla]

Could you please help me with time chart for the same time format?

Thanks in advance

[adonio]

for timechart youll need to convert your time to the field _time
same thing, and now you can | timechart ... as foo | predict foo