How can I convert it to splunk time format?

[ajayrathore]

Hi,

I have a field in the logs like below

2022-12-07T08:40:14.253180536

How can I convert it to splunk time format?

I need to eventually select this field in the table, so the conversion should work within stats

[gcusello]

Hi @ajayrathore ,

what do you mean with "splunk time format"?

if you mean _time (that's epochtime) you can use the strptime function in the eval command

| eval new_time=strptime(your_time, "%Y-%m-%dT%H:%M:%S.9%N")

if instead you're speaking of the time format when a log is acquired and indexed, you have to put in props.conf for that sourcetype:

TIME_FORMAT = %Y-%m-%dT%H:%M:%S.9%N

Ciao.

Giuseppe