Splunk ITSI

Have problem with my timestamp format

jcvytla
New Member

I'm trying to do forecasting on hourly data. I'm getting error , even though I change my time format. need help in converting "3/5/2018 0:49" into unix time stamp.

0 Karma
1 Solution

adonio
Ultra Champion

try this:

| makeresults count=1 | eval time = "3/5/2018 0:49"
| eval in_epoch = strptime(time, "%m/%d/%Y %H:%M")

hope it helps

View solution in original post

0 Karma

lsnow_splunk
Splunk Employee
Splunk Employee

Hi, @jcvytla-

Check out the "convert" command. The syntax for your case would look something like

convert timeformat=%m/%d/%Y %H:%M mktime(existing_time_field) AS epoch_time

but double check the time format if it doesn't seem to be working for you - the lack of leading zeroes in your timestamp might mean that you have to tweak that.

0 Karma

adonio
Ultra Champion

try this:

| makeresults count=1 | eval time = "3/5/2018 0:49"
| eval in_epoch = strptime(time, "%m/%d/%Y %H:%M")

hope it helps

0 Karma

jcvytla
New Member

Could you please help me with time chart for the same time format?

Thanks in advance

0 Karma

adonio
Ultra Champion

for timechart youll need to convert your time to the field _time
same thing, and now you can | timechart ... as foo | predict foo

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...