Getting Data In

How do I convert serial date time?

ckumbier
New Member

How do I convert serial date time (1900 Date System)? For example, I would like to convert
41215.10417 to 11/2/12 2:30 AM

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

Converting to unix time worked for me;

... | eval AAA = (your_time_field - 25569) * 86400 | convert ctime(AAA)

where 25569 is the actual number of days between Jan 1 1900, and Jan 1 1970 (according to some online calendar tool - din't count them myself).

Subtract, multiply, convert, ACTION.

/K

View solution in original post

kristian_kolb
Ultra Champion

Converting to unix time worked for me;

... | eval AAA = (your_time_field - 25569) * 86400 | convert ctime(AAA)

where 25569 is the actual number of days between Jan 1 1900, and Jan 1 1970 (according to some online calendar tool - din't count them myself).

Subtract, multiply, convert, ACTION.

/K

ckumbier
New Member

Works for me.

0 Karma

ckumbier
New Member

I would like to do it at index time but doing it at search would be acceptable.

0 Karma

lukejadamec
Super Champion

Where are you trying to do the conversion? In a search, or at index time?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...