Splunk Search

TIme Conversion

krvamsireddy
Explorer

Hi ,

how to change the below raw time field to yyyy-mm-dd hh:mm:ss

2020-09-09T18:21:12.2685607Z

am using the below query and didnt get any result 

eval time = strftime(activityDateTime,"%Y-%m-%d %H:%M:%S")

Can someone please help

Labels (1)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

@krvamsireddy 

check updated answer.

————————————
If this helps, give a like below.

View solution in original post

thambisetty
SplunkTrust
SplunkTrust

strftime is used to convert unix timestamp to human readable format.

you should use strptime to convert time which is already in human readable format if you need to format it.

| makeresults | eval activityDateTime="2020-09-09T18:21:12.2685607Z"
| eval time = strftime(strptime(activityDateTime,"%Y-%m-%dT%H:%M:%S"),"%Y-%m-%d %H:%M:%S")
————————————
If this helps, give a like below.
0 Karma

krvamsireddy
Explorer

 

krvamsireddy_2-1599812787173.png

 

still in the old format, and time column is still blank 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What do you mean by raw time field? What fields do you have? Do you get anything in the time field you created?

0 Karma

krvamsireddy
Explorer

No i didnt get anything.

raw time field - time format which i get in the event 

activityDateTIme

krvamsireddy_0-1599812918849.png

 

0 Karma

thambisetty
SplunkTrust
SplunkTrust

@krvamsireddy 

check updated answer.

————————————
If this helps, give a like below.

ITWhisperer
SplunkTrust
SplunkTrust

Looks like you need to parse the activityDateTime with strptime and then format that with strftime

 

eval time = strptime(strptime(activityDateTime, "%Y-%m-%dT%H:%M:%S.%Q"),"%Y-%m-%d %H:%M:%S")

Or you could just parse the activityDateTime string into an epoch time and the use fieldformat on the time field for display purposes

 

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Hi Splunky people! We are excited to share the newest updates in Splunk Enterprise 9.3!Admins and Analyst can ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...