how to convert UTC time into mmddyy format

[mtidke]

Hi,

how to convert UTC time into mmddyy format.

I tried this query for search

| makeresults
| eval time
| eval readable_time = strftime(strptime(tostring(time/1000), "%s"), "%m%d%y")
| table time, readable_time

The time format is time: 1717690912746

Thank you 

[yuanliu]

I do not get the question.  Except that you need to put that value into eval, the search does give you 060624.  Isn't this what you are looking for?  What is the question?

| makeresults
| eval time=1717690912746
| eval readable_time = strftime(strptime(tostring(time/1000), "%s"), "%m%d%y")
| table time, readable_time

This is what I get

time	readable_time
1717690912746	060624

 

[antoniolamonica]

Unsure what format "time" is in for you.

You could try converting "time" into unix time (assuming it is populating differently from "_time"), and then converting it back into readable_time:

| eval time=(time, "%H:%M") (this may vary on its current format)
| eval readable_time = strftime(_time, "%m/%d/%Y")

be sure not  to confuse "time" and "_time"
_time is by default in unix time.

https://docs.splunk.com/Documentation/SCS/current/SearchReference/DateandTimeFunctions

If this helped, karma is appreciated.

[deepakc]

| makeresults
| eval time=1717690912746
| eval readable_time = strftime(time,"%m/%d/%y %H:%M:%S")
| table time, readable_time

[mtidke]

I tried this but got an error

Error in 'EvalCommand': Failed to parse the provided arguments. Usage: eval dest_key = expression.
The search job has failed due to an error. You may be able view the job in the