timeformat

[shangshin]

Hi,
Ny log has a timeformat like this -- 4/22/14 12:59:56.000 AM. How can I make the display like 4/22/14 00:59:56.000 AM

I tried to covert the time by using | eval desired_time=strftime(_time, "%H:%M:%S %p") |

However, date_hour is still showing the value of 12.

Thanks in advance!

date_hour

[martin_mueller]

There is no time "00:59 AM". 59 minutes after midnight is "12:59 AM", 59 minutes after noon is "12:59 PM". The 24-hour clock has "00:59" for 59 minutes after midnight, but no AM/PM distinction.

[shangshin]

I assume there is no way to change the index value. As the alternative, I am planning to use

| eval new_date_hour = strftime(_time,"%H")

[somesoni2]

Try this

| eval desired_time=strftime(_time,"%m/%d/%y %I:%M:%S.%3q %p")

[shangshin]

Thanks for the response. I still got the value 12 for date_hour instead of 00