Solved: Splunk time format conversions?

pavanae · ‎05-03-2023

How do I convert the below time format

2023-05-02T02:35:47Z into

2023-05-03 15:37:22

richgalloway · ‎05-03-2023

Use the strptime function to convert the time into epoch form then use strftime to convert the epoch into the desired result.

| eval foo = strftime(strptime(foo, "%Y-%m-%dT%H:%M:%S%Z"), "%Y-%m-%d %H:%M:%S")

---
If this reply helps you, Karma would be appreciated.

richgalloway · ‎05-03-2023

Use the strptime function to convert the time into epoch form then use strftime to convert the epoch into the desired result.

| eval foo = strftime(strptime(foo, "%Y-%m-%dT%H:%M:%S%Z"), "%Y-%m-%d %H:%M:%S")

---
If this reply helps you, Karma would be appreciated.

Splunk time format conversions?