Splunk Search

Convert field representing time to another time format

Explorer

Hi Everybody,

I have a field in my splunk events that is an XML field representing a videoconference session start time called ns2:sessionStartTime. An example of a field value is 2013-03-31T23:12:58.062-07:00. I want to turn this into a number (possibly Unix epoch time?) so I can perform ns2:sessionEndTime - ns2:sessionStartTime and figure out how long the session took. If there's any easier way of doing this calculation I'm all ears. Thanks for any and all help.

Conor

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

You're probably looking for this:

... | eval sessionStartTimeEpoch = strptime(sessionStartTime, "%FT%T.%3N%z")

View solution in original post

SplunkTrust
SplunkTrust

You're probably looking for this:

... | eval sessionStartTimeEpoch = strptime(sessionStartTime, "%FT%T.%3N%z")

View solution in original post

Explorer

perfect, thank you so much!

0 Karma