Splunk Search

Time extraction from string?

asifhj
Path Finder

I have following values in a field

+000 00:00:00.00

+000 00:00:00.03

+000 00:00:43.18

+000 00:00:20.69

+000 00:00:00.04

+000 00:00:00.01

+000 00:00:00.03

I tried the following query to extract

...| eval t = strftime(strptime(CPU_USED,"+%3N %T.%Q"),"%3N %T.%Q") | table t, CPU_USED

I am getting the output as follows

000 00:00:00.000

000 00:00:00.000

000 00:00:43.000

000 00:00:20.000

000 00:00:00.000

000 00:00:00.000

000 00:00:00.000

As u can see I am unable to get the last two digits basically they are milliseconds.

And suggestions?

Regards

Asif J.

0 Karma

adityapavan18
Contributor

Dude..%3N & %Q both denote milliseconds.
http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/Commontimeformatvariables

So i guess splunk timestamp processor is confused..use only one and hopefully it should work

0 Karma
Get Updates on the Splunk Community!

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...