Splunk Search

convert date time to epoch time for sorting

smolcj
Builder

How to convert the date and time in the below format to epoch time?
201303140216
yyyymmddHHMM
here hour and minute is in 12 hours clock, so the time may be 02:16PM
tried converting it using
time=strptime(mytime,"%Y%m%d%I%M")
not seems to be working properly...
please help
Thank You

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

If your time is on a 12-hour clock you will need to list AM or PM in your date string, and read that into strptime with %p, without that the hour is ambiguous.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

If your time is on a 12-hour clock you will need to list AM or PM in your date string, and read that into strptime with %p, without that the hour is ambiguous.

smolcj
Builder

Thanks martin.. I think I have to search some other field for sorting.. Thank you for your help .

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

How do you expect the conversion to epoch to work then? Guessing?

If you have sufficient data and a known starting point you could extrapolate AM/PM over a stream of events based on the rollover from 11 to 12, flipping the A/P every time - that's not robust though.

smolcj
Builder

unfortunately i dont have AM or PM specification in the field 😞

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...