How can I convert "2016-12-17T00:30:00.000+0000" to epoch time?

[m7787579]

How can i convert 2000-12-17T00:30:00.000+0000 to epoch time?

I tried using
1.) eval _time= strptime(_time,"%Y-%m-%dT%H:%M:%S.%3N%z")
2.) eval _time=strptime(_time,"%Y-%m-%dT%H:%M:%S")

I would like to understand how can i convert it into epoch time using strptime function?

[woodcock]

This makes test event:

| makeresults
| eval time="2000-12-17T00:30:00.001+0000"

This is the solution:

| eval _time=strptime(time,"%Y-%m-%dT%H:%M:%S.%3N%z")

[gcusello · Accepted solution]

Hi m7787579,
_time is already in epochtime, you can test this with an easy example

index=_internal | head 1 | eval newdate=strptime("2000-12-17T00:30:00.000+0000","%Y-%m-%dT%H:%M:%S.%3N%z") | eval diff=_time-newdate | table _time newdate diff

or renaming _time in your searches: it's showed in epochtime.

The command | eval another_time= strptime(another_time,"%Y-%m-%dT%H:%M:%S.%3N%z") is useful to convert another time in epochtime.

Bye.
Giuseppe

[niketn]

You have asked question to convert String time to epoch.... However, you are applying the same on _time field which should already be epoch.

Following is a run anywhere example with string time converted to epoch. I have used replace to remove + sign and then %6N.

| makeresults
| eval time="2000-12-17T00:30:00.000+0000"
| replace "+" with "" in time
| eval time=strptime(time,"%Y-%m-%dT%H:%M:%S.%6N")

Following worked for me without replace as well.

| makeresults
| eval time="2000-12-17T00:30:00.000+0000"
| eval time=strptime(time,"%Y-%m-%dT%H:%M:%S.%6N")