time command

[shreyasamin64]

need help on using command strptime/strftime

EX: input: December 7, 2021 1:00:01 PM 

        output: 12/1/2021   13:00:01 

[isoutamo]

Hi

I didn't found formatter where day was without leading space so if this is really what you are wanting, you could try this.

| makeresults
| eval time1 = "December 7, 2021 1:00:01 PM"
| eval time2 = strptime(time1, "%B %e, %Y %I:%M:%S %p")
| eval time3 = strftime(time2, "%m/%e/%Y %H:%M:%S")
| rex field=time3 mode=sed "s,/\s(\d+)/,/\1/,g"
| table time1 time3

If you can accept leading zero then just change later %e -> %d and forget rex.

r. Ismo

 https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables

[ITWhisperer · Accepted solution]

| eval output=strftime(strptime(input,"%B %d, %Y %I:%M:%S %p"),"%m/%d/%Y %H:%M:%S")