Splunk Search

convert date time to epoch time for sorting

smolcj
Builder

How to convert the date and time in the below format to epoch time?
201303140216
yyyymmddHHMM
here hour and minute is in 12 hours clock, so the time may be 02:16PM
tried converting it using
time=strptime(mytime,"%Y%m%d%I%M")
not seems to be working properly...
please help
Thank You

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

If your time is on a 12-hour clock you will need to list AM or PM in your date string, and read that into strptime with %p, without that the hour is ambiguous.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

If your time is on a 12-hour clock you will need to list AM or PM in your date string, and read that into strptime with %p, without that the hour is ambiguous.

smolcj
Builder

Thanks martin.. I think I have to search some other field for sorting.. Thank you for your help .

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

How do you expect the conversion to epoch to work then? Guessing?

If you have sufficient data and a known starting point you could extrapolate AM/PM over a stream of events based on the rollover from 11 to 12, flipping the A/P every time - that's not robust though.

smolcj
Builder

unfortunately i dont have AM or PM specification in the field 😞

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...