How to extract hour from timestamp in format "YYYY-mm-ddTHH:MM:SS.3NZ"?

[pedropiin]

Hi everyone. 

I suppose this is a very simple question, but I'm new to Splunk and I've tried everything that I have knowledge of. 

The field that contains the timestamp is called "payload.eventProcessedAt"
Trying to parse with 

| eval time_var=strptime(payload.eventProcessedAt, "%Y-%m-%dT%H:%M:%S.%3NZ")

 doesn't work, giving my only "null/empty" values. The same occurs with "strftime".

How can I do this?

[livehybrid]

hi @pedropiin 

Does this work?

| eval time_var=strptime(json_extract(_raw,"payload.eventProcessedAt"), "%Y-%m-%dT%H:%M:%S")

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

[ITWhisperer · Accepted solution]

Try like this

| eval time_var=strptime('payload.eventProcessedAt', "%Y-%m-%dT%H:%M:%S.%3NZ")

Field names which contain special characters (including a dot) on the right hand side of an evaluate should be enclosed in single quotes

[pedropiin]

Thank you so much! This was it. 

[gcusello]

Hi @pedropiin ,

let me understand: your datetime to use to exct hours is in epochtime or human readable format?

I understood that you want to extract the hours from your datetime, is it correct?

the strptime function is used to convert from human readable in epochtime, if you have a value in this format: 2025-02-28T14:42:25.123, you can extract the hours valu in two ways:

| eval time_var=strftime(strptime(payload.eventProcessedAt, "%Y-%m-%dT%H:%M:%S.%3NZ"),"%H")

or

| eval time_var=substr(eventProcessedAt,12,2)

Ciao.

Giuseppe