I have the following string:
20170306155556+0000
Splunk doesn't seem to understand that format. I've tried strptime, strftime, convert(auto)...nothing works. How do i get splunk to recognize that (that string is referring to "March 06, 2017, at 15:55:56 UTC).
This works for me (run anywhere sample search)
| gentimes start=-1 | eval date="20170306155556+0000" | table date | eval _time=strptime(date, "%Y%m%d%H%M%S%z")
This works for me (run anywhere sample search)
| gentimes start=-1 | eval date="20170306155556+0000" | table date | eval _time=strptime(date, "%Y%m%d%H%M%S%z")
That worked perfectly! Thanks!