Splunk Search

convert date time to epoch time for sorting

smolcj
Builder

How to convert the date and time in the below format to epoch time?
201303140216
yyyymmddHHMM
here hour and minute is in 12 hours clock, so the time may be 02:16PM
tried converting it using
time=strptime(mytime,"%Y%m%d%I%M")
not seems to be working properly...
please help
Thank You

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

If your time is on a 12-hour clock you will need to list AM or PM in your date string, and read that into strptime with %p, without that the hour is ambiguous.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

If your time is on a 12-hour clock you will need to list AM or PM in your date string, and read that into strptime with %p, without that the hour is ambiguous.

smolcj
Builder

Thanks martin.. I think I have to search some other field for sorting.. Thank you for your help .

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

How do you expect the conversion to epoch to work then? Guessing?

If you have sufficient data and a known starting point you could extrapolate AM/PM over a stream of events based on the rollover from 11 to 12, flipping the A/P every time - that's not robust though.

smolcj
Builder

unfortunately i dont have AM or PM specification in the field 😞

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

AI + Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...

Splunk Technical Support Is Moving to Cisco Support Tools

Introduction Splunk technical support is transitioning to Cisco’s support environment. This change brings ...