#Splunk strftime software#

For example EST for US Eastern Standard Time. For US English the format for 9:30 AM is 9:30:00. The time in the format for the current locale. For example the UNIX epoch time 1484993700 is equal to Tue Jan 21 10:15:00 2020. The UNIX Epoch Time timestamp, or the number of seconds since the Epoch: 00:00:00 +0000 (UTC). Second as a decimal number, for example 00 to 59. %3Q = milliseconds, with values of 000-999.The subsecond component of a UTC timestamp. Use with %I to specify the 12-hour clock for AM or PM. You can specify %3N = milliseconds, %6N = microseconds, %9N = nanoseconds.ĪM or PM. Leading zeros are accepted but not required. Minutes are represented by the values 00 to 59. Leading zeros are replaced by a space, for example 0 to 23. Like %H, the hour (24-hour clock) as a decimal number. Use with %p to specify AM or PM for the 12-hour clock. Hour (12-hour clock) with the hours represented by the values 01 to 12. Hours are represented by the values 00 to 23. Hour (24-hour clock) as a decimal number. For example, Thu Jul 18 09:30: for US English on Linux. The date and time with time zone in the current locale's format as defined by the server's operating system. For example, Thu Jul 18 09:30:00 2019 for US English on Linux. The date and time in the current locale's format as defined by the server's operating system.

For Splunk Enterprise, see Create custom indexes in Managing indexers and clusters of indexers.For Splunk Cloud Platform, see Manage Splunk Cloud Platform indexes in the Splunk Cloud Platform Admin Manual.Subsecond time variables such as %N and %Q can be used in metrics searches of metrics indexes that are enabled for millisecond timestamp resolution.įor more information about enabling metrics indexes to index metric data points with millisecond timestamp precision: See Specify time zones for timestamps in Getting Data In.

#Splunk strftime software#

For more information about how the Splunk software determines a time zone and the tz database, Refer to the list of tz database time zones for all permissible time zone values. You can also use these variables to describe timestamps in event data.Īdditionally, you can use the relative_time() and now() time functions as arguments.įor more information about working with dates and time, see Time modifiers for search and About searching with time in the Search Manual. This topic lists the variables that you can use to define time formats in the evaluation functions, strftime() and strptime().