Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Splunk Search
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- time field extraction
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
krishnarajb2304
Explorer
02-16-2017
01:15 PM
How to extract the below data as time field,
2016-10-20 INFO ............................................................................ data|15 Feb '17| .............................
2016-10-20 INFO ............................................................................ data|16 Feb '17| .............................
2016-10-20 INFO ............................................................................ data|17 Feb '17| .............................
Extracted the _time field but, I need to extract the time field (myfield)....
myfield,
15 Feb '17
16 Feb '17
17 Feb '17
How to convert myfield to timestamp ?
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
vasanthmss
Motivator
02-16-2017
01:19 PM
myfield is the string, epochvalue will have the epoch time. format will be %d %b '%y
your base search, | eval epochvalue=strptime(myfield,"%d %b '%y")
Read further on date variables & strptime https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Commontimeformatvariables
Sample:
|stats c | eval myfield="15 Feb '17" | eval epochvalue=strptime(myfield,"%d %b '%y")
V
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
vasanthmss
Motivator
02-16-2017
01:19 PM
myfield is the string, epochvalue will have the epoch time. format will be %d %b '%y
your base search, | eval epochvalue=strptime(myfield,"%d %b '%y")
Read further on date variables & strptime https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Commontimeformatvariables
Sample:
|stats c | eval myfield="15 Feb '17" | eval epochvalue=strptime(myfield,"%d %b '%y")
V
Get Updates on the Splunk Community!
Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 4)
Welcome back to Splunk Classroom Chronicles, our ongoing series where we shine a light on what really happens ...
From GPU to Application: Monitoring Cisco AI Infrastructure with Splunk Observability ...
AI workloads are different. They demand specialized infrastructure—powerful GPUs, enterprise-grade networking, ...
Application management with Targeted Application Install for Victoria Experience
Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...
