Splunk Search

convert date time to epoch time for sorting

smolcj
Builder

How to convert the date and time in the below format to epoch time?
201303140216
yyyymmddHHMM
here hour and minute is in 12 hours clock, so the time may be 02:16PM
tried converting it using
time=strptime(mytime,"%Y%m%d%I%M")
not seems to be working properly...
please help
Thank You

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

If your time is on a 12-hour clock you will need to list AM or PM in your date string, and read that into strptime with %p, without that the hour is ambiguous.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

If your time is on a 12-hour clock you will need to list AM or PM in your date string, and read that into strptime with %p, without that the hour is ambiguous.

smolcj
Builder

Thanks martin.. I think I have to search some other field for sorting.. Thank you for your help .

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

How do you expect the conversion to epoch to work then? Guessing?

If you have sufficient data and a known starting point you could extrapolate AM/PM over a stream of events based on the rollover from 11 to 12, flipping the A/P every time - that's not robust though.

smolcj
Builder

unfortunately i dont have AM or PM specification in the field 😞

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...