Hi and thanks in advance,
I am trying to convert the following time example field:
2017-03-02T09:41:38.405Z
into a Splunk time format so I can get time windows to use in streamstats.
thing is with the T in the middle and the Z at the end, all the tries I am doing with strptime are failing.
I tried the following:
|eval time=strptime(timeValue,"%Y-%m-%dT%H:%M:%S.%3QZ")
but no luck, any idea?
Rgds,
Juan
2017-03-02T09:41:38.405Z
Like this (The trailing Z
is for Zulu
, AKA GMT
so you need to grab the TZ
with %Z
😞
| eval time=strptime(timeValue,"%Y-%m-%dT%H:%M:%S.%3N%Z")
2017-03-02T09:41:38.405Z
Like this (The trailing Z
is for Zulu
, AKA GMT
so you need to grab the TZ
with %Z
😞
| eval time=strptime(timeValue,"%Y-%m-%dT%H:%M:%S.%3N%Z")
Thanks, sorry for late reply but was trying bits and pieces but couldn't get what I wanted; get the streamstats based on next time specifiead in the json data, not the arrival time. So far no luck on all my tries, not sure if is possible. Will post another question.
Thanks anyway.