Convert time from AM/PM to 24 Hour format

[chandra61446]

index=* "please type serach keyword" host=xyz*
| rex field=_raw "^(?:[^ \n]* ){2}(?P\d+:\d+):\d+\s+\w+\s+\w+:\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\d+\s+(?P\d+:\d+)"]
| dedup host
| convert timeformat="%H:%M:%S" ctime(ServerTime) AS ST
| table ServerTime ST DeviceSyncTime

ServerTime shows in AM/PM format and DeviceSyncTime shows in 24 hour format. How do I change the ServerTime field value to the 24 hour format?

Note I don't want to have _time anywhere..

[somesoni2]

Where are you extracting ServerTime field and what is the format of the value (sample logs will be helpful)?

[chandra61446]

Below id raw data

[10A8:0564-151C] 03/01/2016 09:58:22 PM Traveler: The last successful device sync was on Tue Mar 01 21:58:21 EST 2016.

I am picking 09:58 as ServerTime abd 21:58 as DeviceSyncTime

Now like to ServerTime to converted into 24hours format

[alemarzu · Accepted solution]

Hi there chandra, try with this.

| eval time24hs=strftime(ServerTime, "%H:%M:%S")

Hope it helps.

[chandra61446]

This one worked

| eval epochtime=strptime(Dtime, "%H:%M:%S")| eval DSyncTime=strftime(epochtime, "%I:%M:%S")

[chandra61446]

It did not help .. Below id raw data

[10A8:0564-151C] 03/01/2016 09:58:22 PM Traveler: The last successful device sync was on Tue Mar 01 21:58:21 EST 2016.

I am picking 09:58 as ServerTime abd 21:58 as DeviceSyncTime

Now like to ServerTime to converted into 24hours format

[alemarzu]

Use _time instead ServerTime, like this.

| eval time24hs=strftime(_time, "%H:%M:%S")