Splunk Search

How to convert _time to mm/dd/yyyy Day H:M:S AM/PM

Contributor

My _time format reads 2019-10-13 04:19:21
I try to convert this _time value to the format mm/dd/yyyy day h:m:s AM or PM. Can anyone help me on this?

Thanks,

0 Karma
1 Solution

Esteemed Legend

Like this:

... | fieldformat _time = strftime(_time, "%m/%d/%Y Day %I%M:%S %p")

View solution in original post

Esteemed Legend

Like this:

... | fieldformat _time = strftime(_time, "%m/%d/%Y Day %I%M:%S %p")

View solution in original post

Contributor

It's very close to perfect. I now have 10/13/2019 Day 01:48:35 AM. Is it possible to replace "Day" with an actual day Sunday? so the final format would be: 10/13/2019 Sunday 01:48:35 AM

Thank you,

0 Karma

Esteemed Legend

Like this:

... | fieldformat _time = strftime(_time, "%m/%d/%Y %a %I%M:%S %p")

OR

... | fieldformat _time = strftime(_time, "%m/%d/%Y %A %I%M:%S %p")
0 Karma

Contributor

Perfect! Thank you so much.

0 Karma