Splunk Search

How to convert current timestamp to time using splunk?

Shan
Builder

In my current timestamp filed .
I Have a value like 2015-06-11-083912216431

I need the value like 08:39:12
The above mentioned value are in the format of H:M:S

Thanks in advance.

Tags (2)
0 Karma

twinspop
Influencer

I would convert to time first:

some search | eval MyUNIXTime=strptime(Timestamp,"%Y-%m-%d-%H%M%S%6N") | eval MyTime=strftime(MyUNIXTime,"%T")

Where Timestamp is the field containing your original time string.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

With SED it can be done like this

your base search giving field Timestamp | rex field=Timestamp mode=sed "s/(\d+-\d+-\d+)-(\d{2})(\d{2})(\d{2})(.*)/\1 \2:\3:\4/g"

Do you want to change the Timestamp format at search time OR index time?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here is one way. It may be more efficient to use sed, but someone more experienced with sed will have to answer that.

... | rex field=ts "(?P<date>\d{4}-\d{1,2}-\d{1,2})-(?<hour>\d\d)(?P<minute>\d\d)(?P<seconds>\d\d)(?P<subseconds>\d{0,6})" | eval ts=date.":".hour.":".minute.":".seconds.".".subseconds | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...