Splunk Search

time field extraction

How to extract the below data as time field,

2016-10-20 INFO ............................................................................ data|15 Feb '17| .............................
2016-10-20 INFO ............................................................................ data|16 Feb '17| .............................
2016-10-20 INFO ............................................................................ data|17 Feb '17| .............................

Extracted the _time field but, I need to extract the time field (myfield)....

myfield,
15 Feb '17
16 Feb '17
17 Feb '17

How to convert myfield to timestamp ?

0 Karma
1 Solution

Motivator

myfield is the string, epochvalue will have the epoch time. format will be %d %b '%y

your base search, | eval epochvalue=strptime(myfield,"%d %b '%y")

Read further on date variables & strptime https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Commontimeformatvariables

Sample:

|stats c | eval myfield="15 Feb '17" | eval epochvalue=strptime(myfield,"%d %b '%y")

View solution in original post

Motivator

myfield is the string, epochvalue will have the epoch time. format will be %d %b '%y

your base search, | eval epochvalue=strptime(myfield,"%d %b '%y")

Read further on date variables & strptime https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Commontimeformatvariables

Sample:

|stats c | eval myfield="15 Feb '17" | eval epochvalue=strptime(myfield,"%d %b '%y")

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!