Splunk Search

Convert string to date

shayhk
Explorer

Hi, I am tring to convert string data to date and find diff second
the problem is that i cant convert the string to date

...
|table Key DateTime1 DateTime2

Datetime1&2 formats are [2013-12-17 09:38:57.7667] and they are strings

i want to find the diff seconds between them

Tags (3)
0 Karma

Lowell
Super Champion
<your search>
  | rex " (?<dt1>[0-9-]+ [0-9:.]+) (?<dt2>[0-9-]+ [0-9:.]+)"
  | eval dt1=strptime(dt1,"%Y-%m-%d %H:%M:%S.%3Q")
  | eval dt2=strptime(dt2,"%Y-%m-%d %H:%M:%S.%3Q")
  | eval diff=dt2-dt1

vgdhavale10
New Member

Thanks @Lowell.It worked in my case..

0 Karma

somesoni2
Revered Legend

Have you tried ...|eval DateTime1=strptime(DateTime1,"%Y-%m-%d %H:%M:%S.%3Q")?

0 Karma

sciurus
Path Finder

Is the [ and ] part of the actual value, or are you adding that in to the question? If it's part of the value, timeformat probably needs to know.

0 Karma

jsie_splunk
Splunk Employee
Splunk Employee

Can you provide a raw example of the event? Are you intending to handle the "57" in the above string as the seconds? Or "57.7667"?

0 Karma

shayhk
Explorer

I tried

host=...
| table DateTime1

| convert timeformat="%Y-%m-%d %T" mktime(DateTime1) as _time

but the _time column is empty

the DateTime value is [2013-12-17 09:38:57.7667]

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...