Getting Data In

How to convert date time format from my log parser to Splunk?

guruwells
Explorer

Hi,

I am converting all statements from my log parser tool to Splunk. I didn't get the exact conversion for date and time timezone format.

Please find my search here from log parser.

Log parser:

TO_LOCALTIME(QUANTIZE(TO_TIMESTAMP(date, time), 1)) as Second, COUNT(*) 

I want to convert above statement into Splunk syntax format.

Please help me on this.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

YOu would need to use strptime funtion like this (run anywhere sample, replace line 1 with your search. Mine just generates dummy row)

| gentimes start=-1 | eval YourDateField="2015-06-15 00:00:01" | table YourDateField
| eval YourDateInEpoch=strptime(YourDateField,"%Y-%m-%d %H:%M:%S")   
| eval YourSecondPart=strftime(YourDateInEpoch,"%S")

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

YOu would need to use strptime funtion like this (run anywhere sample, replace line 1 with your search. Mine just generates dummy row)

| gentimes start=-1 | eval YourDateField="2015-06-15 00:00:01" | table YourDateField
| eval YourDateInEpoch=strptime(YourDateField,"%Y-%m-%d %H:%M:%S")   
| eval YourSecondPart=strftime(YourDateInEpoch,"%S")
0 Karma

guruwells
Explorer

Thanks for the quick reply on this. It's really appreciated. what I am doing here is. I am pulling iis log information. I have separate fields which are date and time from my log. first thing is I need to get date and time and same time I need to convert that date into local time.
TO_LOCALTIME(QUANTIZE(TO_TIMESTAMP(date, time), 1)) as Second

Your help is appreciated.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Could you provide the current value of timestamp that you're getting now and what you want to it to transform into (with actual examples)?

0 Karma

guruwells
Explorer

Hi,
Thanks for the reply. My time format in log file is "2016-01-10 08:00:00 ( Pacific time) and I wanted to convert date and time into Eastern time ( example: 2016-01-10 00:00:00). In above statement I am trying to convert server time to local time.

is this information is good enough?. date and time field are seperate fields here.
One more question is here: shall we use "_time" field to retrieve data?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

How does your timestamp looks like , samples?? (you probably need to use function strptime)

0 Karma

guruwells
Explorer

Thanks for the reply. I am looking for date format which is " 2015-06-15 00:00*:01*". something I need to seconds data.

Let me know if you need any info on this.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...