How to convert Day Mon Date HH:mm:ss UTC Year to YYYY-MM-DD HH:MM:SS:Q

[gravi]

Hi, I have a Timestamp field as Fri Nov 22 03:37:15 UTC 2019 and I want to convert into YYYY-MM-DD HH:MM:SS:6Q format.

Have tried using | eval InputTime=strftime(Timestamp,"%Y-%m-%d %H:%M:%S.%6Q") and it doesn't give me anything

Could you please help?

Thanks.

[oscar84x · Accepted solution]

You can try converting it to epoch first then converting it to your desired format:

| makeresults
| eval time ="Fri Nov 22 03:37:15 UTC 2019"
| eval nix= strptime(time , "%a %b %d %H:%M:%S UTC %Y")
| eval newTime=strftime(nix, "%Y-%m-%d %H:%M:%S.%6Q")

[gravi]

Thanks you so much for the answer. I really appreciate it.

And also do you know how to get the difference in datetime fields? Tried eval t=t1-t2 and it gives nothing

[oscar84x]

No problem. Glad to help.
For your other question look at the answer in the link below. Pretty much you'd need to convert your fields to epoch and calculate the difference from that.

https://answers.splunk.com/answers/114818/find-the-difference-between-two-date-time-values.html