Splunk Search

how to convert a filename date to epoch time format?

OmarDee
Explorer
 
Tags (2)
0 Karma

stephane_cyrill
Builder

Hi,
Your question is not explicit but i will try to give you something.

use strftime(X, Y) :

This function takes an epochtime value, X, as the first argument and renders it as a string using the format
specified by Y for example :
... | eval n=strftime(_time, "%H:%M") here n content the values of the field _time but in term of hours and minutes only.

Use ctime(X)
This function Convert an epoch time to an ascii human readable time. Use timeformat option to specify exact format to convert to.

Example ... | convert timeformat="%H:%M:%S" ctime(_time) as timestr

So i think you can replace _time by your field that content your dates and for more types of time format you can take a look in
http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference
in the section Common date and time format variables

tachifelix
Path Finder

for convert filename date to epoch time format try something like this
.....| convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(date) as date
look more detail in search reference manuel

0 Karma

musskopf
Builder

Hmm could pls provide more details/example?

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...