Splunk Search

How can I convert it to splunk time format?

ajayrathore
Loves-to-Learn

Hi,

I have a field in the logs like below

 

 

 

2022-12-07T08:40:14.253180536

 

 

 

How can I convert it to splunk time format?

I need to eventually select this field in the table, so the conversion should work within stats

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ajayrathore ,

what do you mean with "splunk time format"?

if you mean _time (that's epochtime) you can use the strptime function in the eval command

| eval new_time=strptime(your_time, "%Y-%m-%dT%H:%M:%S.9%N")

if instead you're speaking of the time format when a log is acquired and indexed, you have to put in props.conf for that sourcetype:

TIME_FORMAT = %Y-%m-%dT%H:%M:%S.9%N

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...

Getting Started with Splunk Artificial Intelligence, Insights for Nonprofits, and ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...