Splunk Search

Converting AM/PM time to 24 hour time for a view

nlapier2
Path Finder

I have data that contains a field with dates and times formatted as such: "5/18/14 7:04:04.000 PM". The date part is fine, but I want to convert the time from AM/PM to 24 hour format, so the final result would be "5/18/14 19:04:04.000". A macro searches the fields and puts them into a table as such "table timeField field2 field3" and a view then uses that macro to display results. I am wondering if there is some way to change the macro to get the desired format for the time field (or, if not, how else I could get the correct time format for my view).

As a side note, I would have to do this for every single table in the view, so if there's some easier way to force splunk to use the 24 hour format consistently, that would be preferred.

EDIT: I've come across a couple of solutions that involve EventsViewer_DefaultRenderer.html to make en-US views display as if they were using the 24 hour en-GB time format:
http://answers.splunk.com/answers/10265/change-default-web-ui-locale
http://answers.splunk.com/answers/10643/time-format-for-results-in-en-us-vs-en-gb

This is exactly what I'm looking for. However, I followed the instructions in the answers and it did not work for me. My guess is that, since both of those questions and their answers are years old, they are outdated and do not work for Splunk version 6.1.1. Does anyone know what might be causing those solutions to not work? Has anyone tried to use them in 6.1.1 with any success?

Thanks in advance.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You could convert time string this way:

<your search> | eval timestr=strftime(strptime(timestr,"%m/%d/%y %I:%M:%S.$3N %p"),"%m/%d/%y %H:%M:%S.$3N) | ...
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...