Will you help me with this string to date conversion?

[jiaqya]

I'm struggling to convert this to a Splunk readable format.

Sep 18, 2018 17:25:24.870411000

Can you me figure out how to make Splunk understand this as a date format?

[DalJeanis]

https://docs.splunk.com/Documentation/Splunk/7.1.3/SearchReference/Commontimeformatvariables

You have 3-digit month, then day, comma four digit year.

%b %d, %Y 

followed by 24-hour format hour, colon, minute, colon, second

%H:%M:%S

dot, nine digit subsecond interval

.%9Q

Put it all together and you get

%b %d, %Y %H:%M:%S.%9Q

Test it with

| makeresults  
| eval fromtime="Sep 18, 2018 17:25:24.870411000"
| eval _time = strptime(fromtime,"%b %d, %Y %H:%M:%S.%9Q")

And the epoch format result displays as...

2018-09-18 17:25:24.870

[jiaqya]

yes, this works for me too just like above . thank you

John.

[msivill_splunk · Accepted solution]

Try....

| makeresults 
| eval date_string = "Sep 18, 2018 17:25:24.870411000" 
| eval date = strptime(date_string, "%b %d, %Y %H:%M:%S.%f")

This will capture to microsecond. The example date provided goes down to nanosecond level but only seems to use to the microsecond. Will this work for you?

[jiaqya]

Thanks, this works perfectly fine for me..

john.