Splunk Search

Date_hour not returning in 24 hour based on AM/PM

TobiasBoone
Communicator

I have an input file that has lines like:
2/1/2016,10:21AM,8006529721,4,TOLL-FREE

Splunk is accounting for the time correctly in AM/PM however the data_hour values are all being kept in the 12 hour format; so when plotting and selecting for instance out of business hours we don't get good results because we never get an hour value above 12. 1300 to 2400 are lost with the PM.

Any ideas how to get hours back to a 24 hour clock?

0 Karma

TobiasBoone
Communicator

The query isn't the issue, splunk didn't get the time correct at index.

TobiasBoone
Communicator

Almost the same results here...

_time date_hour hour _raw
2015-12-31 02:54:00 2 02 12/31/2015,02:54PM,5074576000,1,xyzname

I would expect date_hour to come back as 14... the eval above bring back a padded 0 value of the same

0 Karma

javiergn
Super Champion

Use eval instead and parse your hour from _time:

yoursearch
| eval hour = strftime(_time, "%H")
| plot using hour
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...