Splunk Search

Convert field representing time to another time format

cosullivan66
Explorer

Hi Everybody,

I have a field in my splunk events that is an XML field representing a videoconference session start time called ns2:sessionStartTime. An example of a field value is 2013-03-31T23:12:58.062-07:00. I want to turn this into a number (possibly Unix epoch time?) so I can perform ns2:sessionEndTime - ns2:sessionStartTime and figure out how long the session took. If there's any easier way of doing this calculation I'm all ears. Thanks for any and all help.

Conor

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You're probably looking for this:

... | eval sessionStartTimeEpoch = strptime(sessionStartTime, "%FT%T.%3N%z")

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You're probably looking for this:

... | eval sessionStartTimeEpoch = strptime(sessionStartTime, "%FT%T.%3N%z")

cosullivan66
Explorer

perfect, thank you so much!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...