Date and time format variables
This topic lists the variables that you can use to define time formats in the evaluation functions, strftime() and strptime(). You can also use these variables to describe timestamps in event data.
Additionally, you can use the
now() time functions as arguments.
Refer to the list of tz database time zones for all permissible time zone values. For more information about how the Splunk software determines a time zone and the tz database, see Specify time zones for timestamps in Getting Data In.
Date and time variables
|%c|| The date and time in the current locale's format as defined by the server's operating system. For example, |
|%+|| The date and time with time zone in the current locale's format as defined by the server's operating system. For example, |
|%Ez||Splunk-specific, timezone in minutes.|
|%H||Hour (24-hour clock) as a decimal number. Hours are represented by the values 00 to 23. Leading zeros are accepted but not required.|
|%I||Hour (12-hour clock) with the hours represented by the values 01 to 12. Leading zeros are accepted but not required.|
|%k||Like %H, the hour (24-hour clock) as a decimal number. Leading zeros are replaced by a space, for example 0 to 23.|
|%M||Minute as a decimal number. Minutes are represented by the values 00 to 59. Leading zeros are accepted but not required.|
|%N||Subseconds with width. (%3N = milliseconds, %6N = microseconds, %9N = nanoseconds)|
|%p||AM or PM.|
|%Q|| The subsecond component of 2017-11-30 23:59:59.999 UTC.
%3Q = milliseconds, with values of 000-999. %6Q = microseconds, with values of 000000-999999. %9Q = nanoseconds, with values of 000000000-999999999.
|%S||Second as a decimal number, for example 00 to 59.|
|%s||The Unix Epoch Time timestamp, or the number of seconds since the Epoch: 1970-01-01 00:00:00 +0000 (UTC). (1484993700 is Sat Jan 21 10:15:00 2017)|
|%T||The time in 24-hour notation (%H:%M:%S). For example 23:59:59.|
|%X|| The time in the format for the current locale. For US English the format for 9:30 AM is |
|%Z|| The timezone abbreviation. For example |
|%z|| The timezone offset from UTC, in hour and minute: +hhmm or -hhmm. For example, for 5 hours before UTC the values is |
|%%||A literal "%" character.|
|%F||Equivalent to %Y-%m-%d (the ISO 8601 date format).|
|%x||The date in the format of the current locale. For example, 7/13/2017 for US English.|
|%A||Full weekday name. (Sunday, ..., Saturday)|
|%a||Abbreviated weekday name. (Sun, ... ,Sat)|
|%d||Day of the month as a decimal number, includes a leading zero. (01 to 31)|
|%e||Like %d, the day of the month as a decimal number, but a leading zero is replaced by a space. (1 to 31)|
|%j||Day of year as a decimal number, includes a leading zero. (001 to 366)|
|%w||Weekday as a decimal number. (0 = Sunday, ..., 6 = Saturday)|
|%b||Abbreviated month name. (Jan, Feb, etc.)|
|%B||Full month name. (January, February, etc.)|
|%m||Month as a decimal number. (01 to 12). Leading zeros are accepted but not required.|
|%y||Year as a decimal number, without the century. (00 to 99). Leading zeros are accepted but not required.|
|%Y||Year as a decimal number with century. For example, 2017.|
|Time format string||Result|
|%b %d, %Y||Feb 11, 2017|
|q|%d%b '%y = %Y-%m-%d|||q|23 Apr '17 = 2017-04-23||
This documentation applies to the following versions of Splunk Cloud™: 6.5.0, 6.5.1, 6.5.1612, 6.6.0, 6.6.1, 6.6.3