Splunk Search

how to convert a filename date to epoch time format?

OmarDee
Explorer
 
Tags (2)
0 Karma

stephane_cyrill
Builder

Hi,
Your question is not explicit but i will try to give you something.

use strftime(X, Y) :

This function takes an epochtime value, X, as the first argument and renders it as a string using the format
specified by Y for example :
... | eval n=strftime(_time, "%H:%M") here n content the values of the field _time but in term of hours and minutes only.

Use ctime(X)
This function Convert an epoch time to an ascii human readable time. Use timeformat option to specify exact format to convert to.

Example ... | convert timeformat="%H:%M:%S" ctime(_time) as timestr

So i think you can replace _time by your field that content your dates and for more types of time format you can take a look in
http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference
in the section Common date and time format variables

tachifelix
Path Finder

for convert filename date to epoch time format try something like this
.....| convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(date) as date
look more detail in search reference manuel

0 Karma

musskopf
Builder

Hmm could pls provide more details/example?

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...