Scribd
Upload
171 views

Splunk Time

This document provides information about date and time formatting codes that can be used in Splunk. It lists various format codes like %Y, %m, %d, %H, %M, %S that can be used to format dates, times, timezones and more in different formats. Examples are given to demonstrate how to use the codes to output dates like 2017-12-31 or times in 12-hour or 24-hour format.

Uploaded by

acme
Copyright
© © All Rights Reserved
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
171 views

Splunk Time

This document provides information about date and time formatting codes that can be used in Splunk. It lists various format codes like %Y, %m, %d, %H, %M, %S that can be used to format dates, times, timezones and more in different formats. Examples are given to demonstrate how to use the codes to output dates like 2017-12-31 or times in 12-hour or 24-hour format.

Uploaded by

acme
Copyright
© © All Rights Reserved
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
You are on page 1/ 2

use

| convert timeformat="%m-%d-%Y %l:%M %p" ctime(_time) AS c_time | table _time,


c_time
or

| eval strf_time =strftime(_time, "%m-%d-%Y %l:%M %p") | table _time, strf_time


This results in

2015-08-13 06:33:17 08-13-2015 6:33 AM

2017-03-02T09:41:38.405Z

Like this (The trailing Z is for Zulu, AKA GMT so you need to grab the TZ with %Z):

| eval time=strptime(timeValue,"%Y-%m-%dT%H:%M:%S.%3N%Z")

eval TimeDiff=itime-ptime

===================================================================================
============

%Y-%m-%d 2017-12-31
%y-%m-%d 17-12-31
%b %d, %Y Feb 11, 2017
q|%d%b '%y = %Y-%m-%d| q|23 Apr '17 = 2017-04-23|

%c The date and time in the current locale's format as defined by the server's
operating system. For example, Mon Jul 13 09:30:00 2017 for US English on Linux.
%+ The date and time with time zone in the current locale's format as defined by
the server's operating system. For example, Mon Jul 13 09:30:00 PDT 2017 for US
English on Linux.

%Ez Splunk-specific, timezone in minutes.


%H Hour (24-hour clock) as a decimal number. Hours are represented by the values
00 to 23. Leading zeros are accepted but not required.
%I Hour (12-hour clock) with the hours represented by the values 01 to 12.
Leading zeros are accepted but not required.
%k Like %H, the hour (24-hour clock) as a decimal number. Leading zeros are
replaced by a space, for example 0 to 23.
%M Minute as a decimal number. Minutes are represented by the values 00 to 59.
Leading zeros are accepted but not required.
%N Subseconds with width. (%3N = milliseconds, %6N = microseconds, %9N =
nanoseconds)
%p AM or PM.
%Q The subsecond component of 2017-11-30 23:59:59.999 UTC.
%3Q = milliseconds, with values of 000-999. %6Q = microseconds, with values of
000000-999999. %9Q = nanoseconds, with values of 000000000-999999999.

%S Second as a decimal number, for example 00 to 59.


%s The Unix Epoch Time timestamp, or the number of seconds since the Epoch:
1970-01-01 00:00:00 +0000 (UTC). (1484993700 is Sat Jan 21 10:15:00 2017)
%T The time in 24-hour notation (%H:%M:%S). For example 23:59:59.
%X The time in the format for the current locale. For US English the format for
9:30 AM is 9:30:00.
%Z The timezone abbreviation. For example EST for US Eastern Standard Time.
%z The timezone offset from UTC, in hour and minute: +hhmm or -hhmm. For
example, for 5 hours before UTC the values is -0500 which is US Eastern Standard
Time.
Examples:

Use %z to specify hour and minute, for example -0500


Use %:z to specify hour and minute separated by a colon, for example -5:00
Use %::z to specify hour minute and second separated with colons, for example
-05:00:00
Use %:::z to specify hour only, for example -05
%% A literal "%" character.

%F Equivalent to %Y-%m-%d (the ISO 8601 date format).


%x The date in the format of the current locale. For example, 7/13/2017 for US
English.

%A Full weekday name. (Sunday, ..., Saturday)


%a Abbreviated weekday name. (Sun, ... ,Sat)
%d Day of the month as a decimal number, includes a leading zero. (01 to 31)
%e Like %d, the day of the month as a decimal number, but a leading zero is
replaced by a space. (1 to 31)
%j Day of year as a decimal number, includes a leading zero. (001 to 366)
%w Weekday as a decimal number. (0 = Sunday, ..., 6 = Saturday)

%b Abbreviated month name. (Jan, Feb, etc.)


%B Full month name. (January, February, etc.)
%m Month as a decimal number. (01 to 12). Leading zeros are accepted but not
required.

%y Year as a decimal number, without the century. (00 to 99). Leading zeros are
accepted but not required.
%Y Year as a decimal number with century. For example, 2017.

You might also like