Splunk Search

Field will not convert time

jason_hotchkiss
Communicator

Hello Splunkers,

I have the following field with a date/time stamp:  2021-02-02 15:58:34.0

I am trying to convert it to a format such as: 1612279887.000 
Ultimately it is my goal to use it in a calculation.

I'm using the following search:

search | fields status_dt
| table status_dt
| rename status_dt AS "x"
| eval y=strptime(x, "%m/%d/%y %H:%M:%S") | eval z= strftime(y,"%d %b %Y")
| table x y z

But all I get is a table that looks like:

x                                                        y                    z
2021-02-02 15:58:34.0

What am I doing wrong?  Thanks in advanced

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Your parse string doesn't match the date format you are using

| eval y=strptime(x, "%Y-%m-%d %H:%M:%S")

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your parse string doesn't match the date format you are using

| eval y=strptime(x, "%Y-%m-%d %H:%M:%S")
0 Karma

jason_hotchkiss
Communicator

Thank you very much!

0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...