I have this data:
cfjbht06,08-Apr-2019,18:01:47,2.9,11.6
Splunk is reading this timestamp as:
4/8/19
6:01:47.200 PM
I do NOT want to capture the hundredths of a second, as this is supposed to be a new field. Each field is separated by a ',' (comma).
So, this is what I'm looking for:
4/8/19
6:01:47 PM
Anything helps! Thanks.
Hi @jkrehrer22
Try this:
| makeresults | eval timestamp_field = "4/8/19 6:01:47.200 PM" | eval timestamp_field= strptime(timestamp_field, "%m/%d/%y %I:%M:%S.%3Q %p") | fieldformat timestamp_field = strftime(timestamp_field, "%d/%m/%Y %H:%M:%S")