Splunk Search

How to convert _time to mm/dd/yyyy Day H:M:S AM/PM

vnguyen46
Contributor

My _time format reads 2019-10-13 04:19:21
I try to convert this _time value to the format mm/dd/yyyy day h:m:s AM or PM. Can anyone help me on this?

Thanks,

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

... | fieldformat _time = strftime(_time, "%m/%d/%Y Day %I%M:%S %p")

View solution in original post

woodcock
Esteemed Legend

Like this:

... | fieldformat _time = strftime(_time, "%m/%d/%Y Day %I%M:%S %p")

vnguyen46
Contributor

It's very close to perfect. I now have 10/13/2019 Day 01:48:35 AM. Is it possible to replace "Day" with an actual day Sunday? so the final format would be: 10/13/2019 Sunday 01:48:35 AM

Thank you,

0 Karma

woodcock
Esteemed Legend

Like this:

... | fieldformat _time = strftime(_time, "%m/%d/%Y %a %I%M:%S %p")

OR

... | fieldformat _time = strftime(_time, "%m/%d/%Y %A %I%M:%S %p")
0 Karma

vnguyen46
Contributor

Perfect! Thank you so much.

0 Karma
Get Updates on the Splunk Community!

Cultivate Your Career Growth with Fresh Splunk Training

Growth doesn’t just happen—it’s nurtured. Like tending a garden, developing your Splunk skills takes the right ...

Introducing a Smarter Way to Discover Apps on Splunkbase

We’re excited to announce the launch of a foundational enhancement to Splunkbase: App Tiering.  Because we’ve ...

How to Send Splunk Observability Alerts to Webex teams in Minutes

As a Developer Evangelist at Splunk, my team and I are constantly tinkering with technology to explore its ...