How do I convert this string into a timestamp? the convert and eval functions don't work.

[gregbo]

I have the following string:

20170306155556+0000

Splunk doesn't seem to understand that format. I've tried strptime, strftime, convert(auto)...nothing works. How do i get splunk to recognize that (that string is referring to "March 06, 2017, at 15:55:56 UTC).

[somesoni2 · Accepted solution]

This works for me (run anywhere sample search)

| gentimes start=-1 | eval date="20170306155556+0000" | table date | eval _time=strptime(date, "%Y%m%d%H%M%S%z")

[gregbo]

That worked perfectly! Thanks!