Splunk Search

How can I change human to epoch time

Communicator

| gentimes start=-1 | eval YourDate="3:21:34 AM 12/8/2014" | table YourDate
| eval epoch1=strptime(YourDate,"%H:%M:%S %p %m/%d/%Y")
| convert timeformat="%H:%M:%S %p %m/%d/%Y" mktime(YourDate) as epoch2

I got the same result for Both AM AND PM,

I changed AM to PM --epoch results is 1418037694.000000 and is same for PM

Tags (2)
0 Karma
1 Solution

Influencer

Because %H is the hour on a 24-hour clock... you need to use %I for the hour on a 12-hour clock. See the docs: https://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/Commontimeformatvariables

Also an updated search to show the difference:

| makeresults count=2 | streamstats count | eval YourDate=if(count=1,"3:21:34 AM 12/8/2014","3:21:34 PM 12/8/2014") | table YourDate 
| eval epoch1h=strptime(YourDate,"%H:%M:%S %p %m/%d/%Y") | convert timeformat="%H:%M:%S %p %m/%d/%Y" mktime(YourDate) as epoch2h 
| eval epoch1i=strptime(YourDate,"%I:%M:%S %p %m/%d/%Y") |  convert timeformat="%U:%M:%S %p %m/%d/%Y" mktime(YourDate) as epoch2i

View solution in original post

Influencer

Because %H is the hour on a 24-hour clock... you need to use %I for the hour on a 12-hour clock. See the docs: https://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/Commontimeformatvariables

Also an updated search to show the difference:

| makeresults count=2 | streamstats count | eval YourDate=if(count=1,"3:21:34 AM 12/8/2014","3:21:34 PM 12/8/2014") | table YourDate 
| eval epoch1h=strptime(YourDate,"%H:%M:%S %p %m/%d/%Y") | convert timeformat="%H:%M:%S %p %m/%d/%Y" mktime(YourDate) as epoch2h 
| eval epoch1i=strptime(YourDate,"%I:%M:%S %p %m/%d/%Y") |  convert timeformat="%U:%M:%S %p %m/%d/%Y" mktime(YourDate) as epoch2i

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!