Hi Everybody,
I have a field in my splunk events that is an XML field representing a videoconference session start time called ns2:sessionStartTime. An example of a field value is 2013-03-31T23:12:58.062-07:00. I want to turn this into a number (possibly Unix epoch time?) so I can perform ns2:sessionEndTime - ns2:sessionStartTime and figure out how long the session took. If there's any easier way of doing this calculation I'm all ears. Thanks for any and all help.
Conor
You're probably looking for this:
... | eval sessionStartTimeEpoch = strptime(sessionStartTime, "%FT%T.%3N%z")
You're probably looking for this:
... | eval sessionStartTimeEpoch = strptime(sessionStartTime, "%FT%T.%3N%z")
perfect, thank you so much!