Hi,
I have a field in the logs like below
2022-12-07T08:40:14.253180536
How can I convert it to splunk time format?
I need to eventually select this field in the table, so the conversion should work within stats
Hi @ajayrathore ,
what do you mean with "splunk time format"?
if you mean _time (that's epochtime) you can use the strptime function in the eval command
| eval new_time=strptime(your_time, "%Y-%m-%dT%H:%M:%S.9%N")
if instead you're speaking of the time format when a log is acquired and indexed, you have to put in props.conf for that sourcetype:
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.9%N
Ciao.
Giuseppe