How can i convert 2000-12-17T00:30:00.000+0000 to epoch time?
I tried using
1.) eval _time= strptime(_time,"%Y-%m-%dT%H:%M:%S.%3N%z")
2.) eval _time=strptime(_time,"%Y-%m-%dT%H:%M:%S")
I would like to understand how can i convert it into epoch time using strptime function?
Hi m7787579,
_time is already in epochtime, you can test this with an easy example
index=_internal | head 1 | eval newdate=strptime("2000-12-17T00:30:00.000+0000","%Y-%m-%dT%H:%M:%S.%3N%z") | eval diff=_time-newdate | table _time newdate diff
or renaming _time in your searches: it's showed in epochtime.
The command | eval another_time= strptime(another_time,"%Y-%m-%dT%H:%M:%S.%3N%z")
is useful to convert another time in epochtime.
Bye.
Giuseppe
This makes test event:
| makeresults
| eval time="2000-12-17T00:30:00.001+0000"
This is the solution:
| eval _time=strptime(time,"%Y-%m-%dT%H:%M:%S.%3N%z")
Hi m7787579,
_time is already in epochtime, you can test this with an easy example
index=_internal | head 1 | eval newdate=strptime("2000-12-17T00:30:00.000+0000","%Y-%m-%dT%H:%M:%S.%3N%z") | eval diff=_time-newdate | table _time newdate diff
or renaming _time in your searches: it's showed in epochtime.
The command | eval another_time= strptime(another_time,"%Y-%m-%dT%H:%M:%S.%3N%z")
is useful to convert another time in epochtime.
Bye.
Giuseppe
You have asked question to convert String time to epoch.... However, you are applying the same on _time field which should already be epoch.
Following is a run anywhere example with string time converted to epoch. I have used replace to remove + sign and then %6N.
| makeresults
| eval time="2000-12-17T00:30:00.000+0000"
| replace "+" with "" in time
| eval time=strptime(time,"%Y-%m-%dT%H:%M:%S.%6N")
Following worked for me without replace as well.
| makeresults
| eval time="2000-12-17T00:30:00.000+0000"
| eval time=strptime(time,"%Y-%m-%dT%H:%M:%S.%6N")