Splunk Search

How do I convert this string into a timestamp? the convert and eval functions don't work.

Communicator

I have the following string:

20170306155556+0000

Splunk doesn't seem to understand that format. I've tried strptime, strftime, convert(auto)...nothing works. How do i get splunk to recognize that (that string is referring to "March 06, 2017, at 15:55:56 UTC).

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

This works for me (run anywhere sample search)

| gentimes start=-1 | eval date="20170306155556+0000" | table date | eval _time=strptime(date, "%Y%m%d%H%M%S%z")

View solution in original post

SplunkTrust
SplunkTrust

This works for me (run anywhere sample search)

| gentimes start=-1 | eval date="20170306155556+0000" | table date | eval _time=strptime(date, "%Y%m%d%H%M%S%z")

View solution in original post

Communicator

That worked perfectly! Thanks!

0 Karma