Splunk Search

How to convert time from file to timestamp

tgdvopab
Path Finder

Hello

I have a extracted field from the raw data including time data like:

16.09.23;11:05:11:652

Now I want to convert this field like the _time field in splunk.

How can I convert this?

Thanks a lot!

0 Karma
1 Solution

inventsekar
SplunkTrust
SplunkTrust

currentTimeField example - 16.09.23;11:05:11:652
considering _time as example - 2016-09-26 11:00

| eval finalTimeFormat = strftime(strptime(currentTimeField,"%y.%m.%d;%H:%M:%S:%3N"),"%Y-%m-%d %H:%M")

View solution in original post

inventsekar
SplunkTrust
SplunkTrust

currentTimeField example - 16.09.23;11:05:11:652
considering _time as example - 2016-09-26 11:00

| eval finalTimeFormat = strftime(strptime(currentTimeField,"%y.%m.%d;%H:%M:%S:%3N"),"%Y-%m-%d %H:%M")
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...