Splunk Search

time command

shreyasamin64
Explorer

need help on using command strptime/strftime

 

EX: input: December 7, 2021 1:00:01 PM 

        output: 12/1/2021   13:00:01 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval output=strftime(strptime(input,"%B %d, %Y %I:%M:%S %p"),"%m/%d/%Y %H:%M:%S")

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

I didn't found formatter where day was without leading space so if this is really what you are wanting, you could try this.

 

| makeresults
| eval time1 = "December 7, 2021 1:00:01 PM"
| eval time2 = strptime(time1, "%B %e, %Y %I:%M:%S %p")
| eval time3 = strftime(time2, "%m/%e/%Y %H:%M:%S")
| rex field=time3 mode=sed "s,/\s(\d+)/,/\1/,g"
| table time1 time3

 

If you can accept leading zero then just change later %e -> %d and forget rex.

r. Ismo

 https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval output=strftime(strptime(input,"%B %d, %Y %I:%M:%S %p"),"%m/%d/%Y %H:%M:%S")
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...