Getting Data In

Converting timestamp to date?

MichaelCohen821
New Member

Hello Splunk Community

I am trying to convert a timestamp, StartTime (current format: 2014-05-09T19:11:52.5165976Z) in my log file data to a simple DD-MON-YY formatting. I have found a number of solutions in these forums, but I cannot seem to get it to work despite numerous attempts.

My original search is: sourcetype="logfile" Status="*" | chart dc(UserId) by StartTime | SORT dc(UserId) desc

I have tried implementing the following code: strptime(StartTime, "%d-%b-%Y") but this makes the Search fail. I’ve also tried using the eval command, but still no results are returned.

Any help would be greatly appreciated.

Thank you,

Mike

Tags (1)
0 Karma

linu1988
Champion

Hi Mike,
The timeformat looks to be simple which splunk should have read it automatically which will mean Starttime=_time(default eventtime)

if not you need a convertion before make it to your usable format. So it would go like this

|eval StartTime=strptime(StartTime, "%Y-%m-%dT%H:%M:%S")|eval StartTime=strftime(StartTime,"%d-%b-%Y")

OR
|eval StartTime=strptime(StartTime, "%Y-%m-%dT%H:%M:%S")|convert timeformat="%d-%b-%Y" ctime(StartTime)

Thanks

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...