Can you help me convert a time format to a human readable form?

[mbasharat]

Hi,

I have the below time format, which I want to convert to a human readable form. A few options would be great.

Thanks in advance.

2019-02-11 10:22:57.533328+00

[chrisyounger · Accepted solution]

Try this:

| eval epoch = strptime("2019-02-11 10:22:57.533328+00", "%Y-%m-%d %H:%M:%S.%6Q%Z")

Then display like so: (you can mix and match)

| eval friendly = strftime(epoch, "%Y-%m-%d") 2017-12-31
| eval friendly = strftime(epoch, "%d %b %y") 3 Feb 17
| eval friendly = strftime(epoch, "%d %B %y") 3 February 2017
| eval friendly = strftime(epoch, "%I:%M:%S %p") 5:45:33 pm
| eval friendly = strftime(epoch, "%H:%M:%S") 17:45:33

[mbasharat]

Hi Chris,

Here is my sample query and it is not working. The start_date and end_date are in above format and I need them to be readable. Thanks in advance.

index=ABC
| stats dc(profile_name) by profile_name, start_date,end_date
| eval start_date = strptime("start_date", "%Y-%m-%d %H:%M:%S.%6Q%Z")
| table profile_name, start_date, end_date

[chrisyounger]

Try this:

index=ABC
| stats dc(profile_name) by profile_name, start_date,end_date
| eval start_date = strptime(start_date, "%Y-%m-%d %H:%M:%S.%6Q%Z")
| table profile_name, start_date, end_date

[mbasharat]

Great!

So I used below:

index=ABC
| stats dc(profile_name) by profile_name, start_date,end_date
| eval start_date = strptime(start_date, "%Y-%m-%d %H:%M:%S.%6Q%Z")
| eval Start_Time = strftime(start_date, "%B %d, %Y at %H:%M:%S")
| table profile_name, Start_Time, end_date

Result is: February 11,2019 at 02:00:04

THANK YOU!!!! 😉

[chrisyounger]

good stuff