Splunk Search

How to convert Local time to XML time format?

Builder

Hi

How to convert EVENTLOCALTIME="2017-04-06 15:49:29.0" this time into XML time format?

Tags (1)
0 Karma

SplunkTrust
SplunkTrust

Acceptable XML time formats are established by ISO8601. One of them is just the same thing you have there, with a T instead of a space between the day and the hour. So, the easy way -- not technically proper, perhaps, but easy -- is to put a T where the space is.

Unfortunately, it also should be expressed in UTC, not a local time zone, so you'll need to use relative_time to adjust by whatever the local offset from GMT is. So, in actuality, you need to pull the time into epoch format, convert to GMT/UT, and then convert to ISO8601 time format. This could all be done in a single line, but I've presented the steps sequentially so that you can read it easier.

| eval EVENT_LOCAL_EPOCH = strptime(EVENT_LOCAL_TIME,"%Y-%m-%d %H:%M:%S.%1Q")
| eval myGMToffset="+5h"
| eval EVENT_UTC_EPOCH = relative_time(EVENT_LOCAL_EPOCH,myGMToffset)
| eval EVENT_ISO8601_TIME = strftime(EVENT_UTC_EPOCH,"%Y-%m-%dT%H:%M:%S.%1Q")
0 Karma

SplunkTrust
SplunkTrust

Is EVENTLOCALTIME epoch or string time? Have you tried strptime or strftime function? Can you add example of XML format? What is the context for conversion...Is the conversion required only for display or underlying value has to be converted?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma