Splunk Search

How to convert this string into a usable time format?

Path Finder

Hi and thanks in advance,

I am trying to convert the following time example field:

2017-03-02T09:41:38.405Z    

into a Splunk time format so I can get time windows to use in streamstats.
thing is with the T in the middle and the Z at the end, all the tries I am doing with strptime are failing.
I tried the following:

|eval time=strptime(timeValue,"%Y-%m-%dT%H:%M:%S.%3QZ") 

but no luck, any idea?

Rgds,
Juan

0 Karma
1 Solution

Esteemed Legend

2017-03-02T09:41:38.405Z

Like this (The trailing Z is for Zulu, AKA GMT so you need to grab the TZ with %Z😞

| eval time=strptime(timeValue,"%Y-%m-%dT%H:%M:%S.%3N%Z")

View solution in original post

0 Karma

Esteemed Legend

2017-03-02T09:41:38.405Z

Like this (The trailing Z is for Zulu, AKA GMT so you need to grab the TZ with %Z😞

| eval time=strptime(timeValue,"%Y-%m-%dT%H:%M:%S.%3N%Z")

View solution in original post

0 Karma

Path Finder

Thanks, sorry for late reply but was trying bits and pieces but couldn't get what I wanted; get the streamstats based on next time specifiead in the json data, not the arrival time. So far no luck on all my tries, not sure if is possible. Will post another question.

Thanks anyway.

0 Karma