I have data that contains a field with dates and times formatted as such: "5/18/14 7:04:04.000 PM". The date part is fine, but I want to convert the time from AM/PM to 24 hour format, so the final result would be "5/18/14 19:04:04.000". A macro searches the fields and puts them into a table as such "table timeField field2 field3" and a view then uses that macro to display results. I am wondering if there is some way to change the macro to get the desired format for the time field (or, if not, how else I could get the correct time format for my view).
As a side note, I would have to do this for every single table in the view, so if there's some easier way to force splunk to use the 24 hour format consistently, that would be preferred.
EDIT: I've come across a couple of solutions that involve EventsViewer_DefaultRenderer.html to make en-US views display as if they were using the 24 hour en-GB time format:
http://answers.splunk.com/answers/10265/change-default-web-ui-locale
http://answers.splunk.com/answers/10643/time-format-for-results-in-en-us-vs-en-gb
This is exactly what I'm looking for. However, I followed the instructions in the answers and it did not work for me. My guess is that, since both of those questions and their answers are years old, they are outdated and do not work for Splunk version 6.1.1. Does anyone know what might be causing those solutions to not work? Has anyone tried to use them in 6.1.1 with any success?
Thanks in advance.
