Can you help me format system time?

[jip31]

hi,

I need to format SystemTime='2018-12-27T04:26:29.200782700Z' like this :
yy:mm:dd hh:mm

Could you help me please???

[p_gurav · Accepted solution]

Try this:

| eval t=strptime(SystemTime, "%Y-%m-%dT%H:%M:%S.%9Q") | eval t1=strftime(t, "%Y-%m-%d %H:%M")

[richgalloway]

Don't forget the "%Z" in the strptime format string to pick up the time zone. Also, use "%y" for two-digit year.

You can also combine these commands into a single eval: | eval SystemTime=strftime(strptime(SystemTime, "%Y-%m-%dT%H:%M:%S.%9Q%Z"), "%y-%m-%d %H:%M")

[jip31]

thanks
but i have forgotten to say this field which exact name is "TimeCreated SystemTime" is in an xml log
so how to extract this specific field and to format it in the same time please??

25043200x8000000000000000103251SystemTOTA302000

[richgalloway]

Use xpath or rex to extract the field. The formatting is the same.

[jip31]

hi
I dont know how to do the rex....
you can see the logs here
https://cjoint.com/c/HLDpeThG7Qd

[richgalloway]

A copy-and-paste sample of the log is easier to work with than an image.

Try this rex command to extract the time field:

`... | rex "SystemTime='(?<SystemTime>[^']+)" | ...`

[jip31]

thanks a lot