Convert field representing time to another time format

[cosullivan66]

Hi Everybody,

I have a field in my splunk events that is an XML field representing a videoconference session start time called ns2:sessionStartTime. An example of a field value is 2013-03-31T23:12:58.062-07:00. I want to turn this into a number (possibly Unix epoch time?) so I can perform ns2:sessionEndTime - ns2:sessionStartTime and figure out how long the session took. If there's any easier way of doing this calculation I'm all ears. Thanks for any and all help.

Conor

[martin_mueller · Accepted solution]

You're probably looking for this:

... | eval sessionStartTimeEpoch = strptime(sessionStartTime, "%FT%T.%3N%z")

[cosullivan66]

perfect, thank you so much!