Splunk Search

Will you help me with this string to date conversion?

jiaqya
Builder

I'm struggling to convert this to a Splunk readable format.

Sep 18, 2018 17:25:24.870411000

Can you me figure out how to make Splunk understand this as a date format?

0 Karma
1 Solution

msivill_splunk
Splunk Employee
Splunk Employee

Try....

| makeresults 
| eval date_string = "Sep 18, 2018 17:25:24.870411000" 
| eval date = strptime(date_string, "%b %d, %Y %H:%M:%S.%f")

This will capture to microsecond. The example date provided goes down to nanosecond level but only seems to use to the microsecond. Will this work for you?

View solution in original post

0 Karma

DalJeanis
Legend

https://docs.splunk.com/Documentation/Splunk/7.1.3/SearchReference/Commontimeformatvariables

You have 3-digit month, then day, comma four digit year.

%b %d, %Y 

followed by 24-hour format hour, colon, minute, colon, second

%H:%M:%S

dot, nine digit subsecond interval

.%9Q

Put it all together and you get

%b %d, %Y %H:%M:%S.%9Q

Test it with

| makeresults  
| eval fromtime="Sep 18, 2018 17:25:24.870411000"
| eval _time = strptime(fromtime,"%b %d, %Y %H:%M:%S.%9Q")

And the epoch format result displays as...

2018-09-18 17:25:24.870
0 Karma

jiaqya
Builder

yes, this works for me too just like above . thank you

John.

0 Karma

msivill_splunk
Splunk Employee
Splunk Employee

Try....

| makeresults 
| eval date_string = "Sep 18, 2018 17:25:24.870411000" 
| eval date = strptime(date_string, "%b %d, %Y %H:%M:%S.%f")

This will capture to microsecond. The example date provided goes down to nanosecond level but only seems to use to the microsecond. Will this work for you?

0 Karma

jiaqya
Builder

Thanks, this works perfectly fine for me..

john.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...