Splunk Search
Highlighted

How do you get Splunk to change timestamps from a lookup table?

Communicator

We are using a lookuptable with CSV's for reports. However, the _time field has the following format for time:

2015-06-10T20:04:51.254843Z

How do I get Splunk to interpret that for _time?

Is there a way to edit the _time field to get rid of everything from the "T" on and show 2015-06-10 and use strptime?

Thanks!

0 Karma
Highlighted

Re: How do you get Splunk to change timestamps from a lookup table?

SplunkTrust
SplunkTrust

This time can be parsed by strptime without any changes. For example

|makeresults | eval time = "2015-06-10T20:04:51.254843Z" | eval parsedTime = strptime(time, "%Y-%m-%dT%H:%M:%S.%6QZ")

View solution in original post

Highlighted

Re: How do you get Splunk to change timestamps from a lookup table?

Communicator

It works somewhat, but the eval of 2015-06-10T20:04:51.254843Z converts the time to:

2019-02-07 10:09:54

The time should be June 10, 2015.

I'm trying to get Spunk to interpret the format of our time field " 2015-06-10T20:04:51.254843Z" to make a time graph.

?

0 Karma
Highlighted

Re: How do you get Splunk to change timestamps from a lookup table?

Influencer

you need to assign _time to the lookup time value.

For ex.

eval _time=strptime(lookuptime,"%Y-%m-%dT%H:%M:%S.%6QZ")
Highlighted

Re: How do you get Splunk to change timestamps from a lookup table?

Communicator

| inputlookup REPORT.csv | eval time=strptime(lastLogonTimestamp,"%m/%d/%y")

The above seemed to work.

Thanks everyone!

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.