Great 🙂 Hopefully this is solved then. ... View more

This solution doesn't appear to account for timezone, which Splunk automatically adjusts for. By adding a % before the Z, Splunk will not perform this adjustment, which unless you have your timezone set as GMT you dont want (this assumes its ACTUALLY zulu time). Assuming you dont need to do the hyphen replacement, you can also shorthand the format to "%FT%T.%5N%Z" The solution thus becomes: eval time = strptime("2013-03-27T21:00:32.950000000Z", "%FT%T.%5N%Z") or eval time = strptime("2013-03-27T21:00:32.950000000Z", "%Y-%m-%dT%H:%M:%S.%9N%Z") ... View more