Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to convert 12 hours to 24 hours?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I want to convert my date field from 12 hours to 24 hours.
I have the date field as "2/27/2018 10:21:03 PM" and would like to convert as "2018-03-27 22:21:03"
I tried the below and it didn't work.
| eval epochtime=strptime("2/27/2018 10:21:00 PM", "%m/%d/%Y %H:%M:%S %p")
| eval DSyncTime=strftime(epochtime, "%Y-%m-%d %H:%M:%S")
Output i am getting as 2018-02-27 10:41:00.
Its not considering AM/PM.
Can someone help me please.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@angelinealex, you would need to convert your timestamp in data using %I i.e. 12 hour clock in the strptime() function and then convert the same back to strftime() using %H for 24 hour clock. PS: I have used %p in strftime() for validating the AM/PM is being picked up as expected.
| makeresults
| eval epochtime=strptime("2/27/2018 10:21:03 PM","%m/%d/%Y %I:%M:%S %p")
| eval DSyncTime=strftime(epochtime, "%Y-%m-%d %H:%M:%S %p")
Please refer to Splunk Documentation for strptime()/strftime() time formats
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@angelinealex, you would need to convert your timestamp in data using %I i.e. 12 hour clock in the strptime() function and then convert the same back to strftime() using %H for 24 hour clock. PS: I have used %p in strftime() for validating the AM/PM is being picked up as expected.
| makeresults
| eval epochtime=strptime("2/27/2018 10:21:03 PM","%m/%d/%Y %I:%M:%S %p")
| eval DSyncTime=strftime(epochtime, "%Y-%m-%d %H:%M:%S %p")
Please refer to Splunk Documentation for strptime()/strftime() time formats
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It worked. Thank you very much.
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
