Splunk Search

How to convert time format?

splunk_enjoyer
Explorer

Hello Splunk Lovers! i have date format 202211131614220000 and i want convert this format to readble for Splunk

i should use strptime and strftime, but i have some problems. Please, give me prompt

Labels (1)
Tags (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

@splunk_enjoyer You need to state your question clearly.  "Have problems" is not a question.  What is the definition of "readable for Splunk"?  Splunk only understands epoch, so strptime is your answer.  The string you illustrated looks like some combination of 4-digit year followed by some representation of month, day, hour, etc.  Such may be obvious to you.  But unless you can tell others what exact format it really is, others can only speculate like @inventsekar did.  If you actually mean "readable by humans," and you don't care whether Splunk can use it to perform calculations based on epoch, you can use string manipulation to do so, e.g., you can do something as crazy as

| eval readable_time = replace(timestamp, "^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\d+)", "\1-\2-\3T\4:\5:\6.\7-00:00")

provided the format is 4-digit year, 2-digit month, 2-digit day, 2-digit hour, 2-digit minute, 2-digit second,  4-digit subsecond (like @inventsekar speculated), and the desired output format is something resembling ISO with Zulu time zone.  Remember, it is unfair to make volunteers read your mind.  Make your question as clear as possible.

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @splunk_enjoyer ..

Please check this:

| makeresults | eval timestamp="202211131614220000" 
| eval goodtimestamp = strftime(strptime(timestamp,"%Y%m%d%H%M%S%4Q"),"%m/%d/%Y %H:%M:%S")
|table timestamp goodtimestamp

 

splunk-timestamp.png

splunk_enjoyer
Explorer

its works! thanks man!
sorry, i had some problems, take your karma. thanks a lot! 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...