How can I change human to epoch time

[nagarjuna280]

| gentimes start=-1 | eval YourDate="3:21:34 AM 12/8/2014" | table YourDate
| eval epoch1=strptime(YourDate,"%H:%M:%S %p %m/%d/%Y")
| convert timeformat="%H:%M:%S %p %m/%d/%Y" mktime(YourDate) as epoch2

I got the same result for Both AM AND PM,

I changed AM to PM --epoch results is 1418037694.000000 and is same for PM

[acharlieh · Accepted solution]

Because %H is the hour on a 24-hour clock... you need to use %I for the hour on a 12-hour clock. See the docs: https://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/Commontimeformatvariables

Also an updated search to show the difference:

| makeresults count=2 | streamstats count | eval YourDate=if(count=1,"3:21:34 AM 12/8/2014","3:21:34 PM 12/8/2014") | table YourDate 
| eval epoch1h=strptime(YourDate,"%H:%M:%S %p %m/%d/%Y") | convert timeformat="%H:%M:%S %p %m/%d/%Y" mktime(YourDate) as epoch2h 
| eval epoch1i=strptime(YourDate,"%I:%M:%S %p %m/%d/%Y") |  convert timeformat="%U:%M:%S %p %m/%d/%Y" mktime(YourDate) as epoch2i