Splunk Search

How to extract just the date from a timestamp converted from epoch time?

ECovell
Path Finder

I have a conversion set up to change the epoch time | convert ctime(_time) as date time. I would like to keep just the date and ditch the time function.

The field looks like this: 10/20/2015 06:30:15

Thank you for any help

1 Solution

ppablo
Retired

Hi @ECovell

You could use the timeformat argument for convert to specify the format you want right away.

|convert timeformat="%m/%d/%Y" ctime(_time) AS date

Or you could use the eval strftime function instead and specify the format.

|eval date=strftime(_time, "%m/%d/%Y")

View solution in original post

ppablo
Retired

Hi @ECovell

You could use the timeformat argument for convert to specify the format you want right away.

|convert timeformat="%m/%d/%Y" ctime(_time) AS date

Or you could use the eval strftime function instead and specify the format.

|eval date=strftime(_time, "%m/%d/%Y")

ECovell
Path Finder

Thank you so very much!!

0 Karma

ppablo
Retired

You're very welcome 🙂

0 Karma

AdsicSplunk
New Member

Hi @ppablo_splunk,

Can we use the above in alerts as well? For example:- $job.earliestTime$ gives me "2018-04-04T00:00:00.000+04:00" wheras I want only "2018-04-04".

0 Karma

nikitasharma96
New Member

HI everyone 

 

did you find this answer? i am also looking for same.

covert time stamp 2023-10-20T05:30:00+05:30  to date 

 

 

@AdsicSplunk @ECovell @ppablo  @splunkdate

@Rex @Eval 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...