Training + Certification Discussions

What are the available date-time variables?


Does anyone know where to find documentation for date & time variables? I can't find it anywhere.

I some of them, %m for month, %y for year, etc...

Tags (2)


Here is a link to a nicely formatted table that I found in the Python documentation

Scroll to the middle of the page, in the section for time.strftime

0 Karma

Splunk Employee
Splunk Employee

From the documentation:

 Enhanced strptime() support

 Configure timestamp parsing in props.conf with the TIME_FORMAT= key. Splunk implements an enhanced version of Unix strptime() that supports additional formats (allowing for microsecond, millisecond, any time width format, and some additional time formats for compatibility). See the table below for a list of the additionally supported strptime() formats.

 In previous versions, Splunk parsed timestamps using only the standard Linux strptime() conversion specifications. Now, in addition to standard Unix strptime() formats, Splunk's strptime() implementation supports recognition of the following date-time formats:
%N  For GNU date-time nanoseconds. Specify any sub-second parsing by providing the width: %3N = milliseconds, %6N = microseconds, %9N = nanoseconds.
%Q,%q   For milliseconds, microseconds for Apache Tomcat. %Q and %q can format any time resolution if the width is specified.
%I  For hours on a 12-hour clock format. If %I appears after %S or %s (like "%H:%M:%S.%l") it takes on the log4cpp meaning of milliseconds.
%+  For standard UNIX date format timestamps.
%v  For BSD and OSX standard date format.
%z, %::z, %:::z GNU libc support.
%o  For AIX timestamp support (%o used as an alias for %Y).
%p  The locale's equivalent of AM or PM. (Note: there may be none.)

strptime() format expression examples    
Here are some sample date formats with the strptime() expressions that handle them:
1998-12-31   %Y-%m-%d
98-12-31     %y-%m-%d
1998 years, 312 days     %Y years, %j days
Jan 24, 2003     %b %d, %Y
January 24, 2003     %B %d, %Y
q|25 Feb '03 = 2003-02-25|  q|%d %b '%y = %Y-%m-%d|     

Note: Splunk does not currently recognize non-English month names in timestamps. If you have an app that's writing non-English month names to log files, reconfigure the app to use numerical months, if possible. 

Here is the link

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...