Training + Certification Discussions

What are the available date-time variables?


Does anyone know where to find documentation for date & time variables? I can't find it anywhere.

I some of them, %m for month, %y for year, etc...

Tags (2)


Here is a link to a nicely formatted table that I found in the Python documentation

Scroll to the middle of the page, in the section for time.strftime

0 Karma

Splunk Employee
Splunk Employee

From the documentation:

 Enhanced strptime() support

 Configure timestamp parsing in props.conf with the TIME_FORMAT= key. Splunk implements an enhanced version of Unix strptime() that supports additional formats (allowing for microsecond, millisecond, any time width format, and some additional time formats for compatibility). See the table below for a list of the additionally supported strptime() formats.

 In previous versions, Splunk parsed timestamps using only the standard Linux strptime() conversion specifications. Now, in addition to standard Unix strptime() formats, Splunk's strptime() implementation supports recognition of the following date-time formats:
%N  For GNU date-time nanoseconds. Specify any sub-second parsing by providing the width: %3N = milliseconds, %6N = microseconds, %9N = nanoseconds.
%Q,%q   For milliseconds, microseconds for Apache Tomcat. %Q and %q can format any time resolution if the width is specified.
%I  For hours on a 12-hour clock format. If %I appears after %S or %s (like "%H:%M:%S.%l") it takes on the log4cpp meaning of milliseconds.
%+  For standard UNIX date format timestamps.
%v  For BSD and OSX standard date format.
%z, %::z, %:::z GNU libc support.
%o  For AIX timestamp support (%o used as an alias for %Y).
%p  The locale's equivalent of AM or PM. (Note: there may be none.)

strptime() format expression examples    
Here are some sample date formats with the strptime() expressions that handle them:
1998-12-31   %Y-%m-%d
98-12-31     %y-%m-%d
1998 years, 312 days     %Y years, %j days
Jan 24, 2003     %b %d, %Y
January 24, 2003     %B %d, %Y
q|25 Feb '03 = 2003-02-25|  q|%d %b '%y = %Y-%m-%d|     

Note: Splunk does not currently recognize non-English month names in timestamps. If you have an app that's writing non-English month names to log files, reconfigure the app to use numerical months, if possible. 

Here is the link

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...