How to convert 12 hours to 24 hours?

[angelinealex]

I want to convert my date field from 12 hours to 24 hours.

I have the date field as "2/27/2018 10:21:03 PM" and would like to convert as "2018-03-27 22:21:03"

I tried the below and it didn't work.

| eval epochtime=strptime("2/27/2018 10:21:00 PM", "%m/%d/%Y %H:%M:%S %p")
| eval DSyncTime=strftime(epochtime, "%Y-%m-%d %H:%M:%S")

Output i am getting as 2018-02-27 10:41:00.

Its not considering AM/PM.

Can someone help me please.

[niketn · Accepted solution]

@angelinealex, you would need to convert your timestamp in data using %I i.e. 12 hour clock in the strptime() function and then convert the same back to strftime() using %H for 24 hour clock. PS: I have used %p in strftime() for validating the AM/PM is being picked up as expected.

| makeresults
| eval epochtime=strptime("2/27/2018 10:21:03 PM","%m/%d/%Y %I:%M:%S %p")
| eval DSyncTime=strftime(epochtime, "%Y-%m-%d %H:%M:%S %p")

Please refer to Splunk Documentation for strptime()/strftime() time formats

[angelinealex]

It worked. Thank you very much.