How can i convert String Type Time field(a) to a human readable Date Type Time field(#)?

[joy76]

Splunk version 4.3

I want to sort human readable Time Field in Table results.

Date Type _time(timestamp) field is sorting well.
But String Type Time field is not sorting.

I tried to convert String Type Time to unixtime type, and convert unixtime type to human readable format.
but, I can't convert to human readable Date Time format.

Thanks. Everyone.

[ghostworks · Accepted solution]

Hi~ joy76~

First, a specific time-formatted filed is converted by mktime().
And then, use fieldformat command

• example

field: Rebooting_Time

value: 2010-02-08 09:20:01

type: string

search
| convert timeformat="%Y-%m-%d %T" mktime(Rebooting_Time)  
| fieldformat Rebooting_Time=strftime(Rebooting_Time,"%Y-%m-%d %T")  
| Table Rebooting_Time

As a Result, values of Rebooting_Time is not only displayed for human readable time, but also it was sorted by time.

[bwooden]

You can also use an eval command instead of the convert command. This allows that logic to be performed automatically via calculated fields.

| eval Rebooting_Time=strptime(Rebooting_Time,"%Y-%m-%d %H:%M:%S")