Splunk Search

how to convert a filename date to epoch time format?

OmarDee
Explorer
 
Tags (2)
0 Karma

stephane_cyrill
Builder

Hi,
Your question is not explicit but i will try to give you something.

use strftime(X, Y) :

This function takes an epochtime value, X, as the first argument and renders it as a string using the format
specified by Y for example :
... | eval n=strftime(_time, "%H:%M") here n content the values of the field _time but in term of hours and minutes only.

Use ctime(X)
This function Convert an epoch time to an ascii human readable time. Use timeformat option to specify exact format to convert to.

Example ... | convert timeformat="%H:%M:%S" ctime(_time) as timestr

So i think you can replace _time by your field that content your dates and for more types of time format you can take a look in
http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference
in the section Common date and time format variables

tachifelix
Path Finder

for convert filename date to epoch time format try something like this
.....| convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(date) as date
look more detail in search reference manuel

0 Karma

musskopf
Builder

Hmm could pls provide more details/example?

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...