Getting Data In

How to convert date time format from my log parser to Splunk?

guruwells
Explorer

Hi,

I am converting all statements from my log parser tool to Splunk. I didn't get the exact conversion for date and time timezone format.

Please find my search here from log parser.

Log parser:

TO_LOCALTIME(QUANTIZE(TO_TIMESTAMP(date, time), 1)) as Second, COUNT(*) 

I want to convert above statement into Splunk syntax format.

Please help me on this.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

YOu would need to use strptime funtion like this (run anywhere sample, replace line 1 with your search. Mine just generates dummy row)

| gentimes start=-1 | eval YourDateField="2015-06-15 00:00:01" | table YourDateField
| eval YourDateInEpoch=strptime(YourDateField,"%Y-%m-%d %H:%M:%S")   
| eval YourSecondPart=strftime(YourDateInEpoch,"%S")

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

YOu would need to use strptime funtion like this (run anywhere sample, replace line 1 with your search. Mine just generates dummy row)

| gentimes start=-1 | eval YourDateField="2015-06-15 00:00:01" | table YourDateField
| eval YourDateInEpoch=strptime(YourDateField,"%Y-%m-%d %H:%M:%S")   
| eval YourSecondPart=strftime(YourDateInEpoch,"%S")
0 Karma

guruwells
Explorer

Thanks for the quick reply on this. It's really appreciated. what I am doing here is. I am pulling iis log information. I have separate fields which are date and time from my log. first thing is I need to get date and time and same time I need to convert that date into local time.
TO_LOCALTIME(QUANTIZE(TO_TIMESTAMP(date, time), 1)) as Second

Your help is appreciated.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Could you provide the current value of timestamp that you're getting now and what you want to it to transform into (with actual examples)?

0 Karma

guruwells
Explorer

Hi,
Thanks for the reply. My time format in log file is "2016-01-10 08:00:00 ( Pacific time) and I wanted to convert date and time into Eastern time ( example: 2016-01-10 00:00:00). In above statement I am trying to convert server time to local time.

is this information is good enough?. date and time field are seperate fields here.
One more question is here: shall we use "_time" field to retrieve data?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

How does your timestamp looks like , samples?? (you probably need to use function strptime)

0 Karma

guruwells
Explorer

Thanks for the reply. I am looking for date format which is " 2015-06-15 00:00*:01*". something I need to seconds data.

Let me know if you need any info on this.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...