Hi,
Ny log has a timeformat like this -- 4/22/14 12:59:56.000 AM. How can I make the display like 4/22/14 00:59:56.000 AM
I tried to covert the time by using | eval desired_time=strftime(_time, "%H:%M:%S %p") |
However, date_hour is still showing the value of 12.
Thanks in advance!
date_hour
There is no time "00:59 AM". 59 minutes after midnight is "12:59 AM", 59 minutes after noon is "12:59 PM". The 24-hour clock has "00:59" for 59 minutes after midnight, but no AM/PM distinction.
I assume there is no way to change the index value. As the alternative, I am planning to use
| eval new_date_hour = strftime(_time,"%H")
Try this
| eval desired_time=strftime(_time,"%m/%d/%y %I:%M:%S.%3q %p")
Thanks for the response. I still got the value 12 for date_hour instead of 00