Splunk® Enterprise

Search Reference

Download manual as PDF

Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Common date and time format variables

This topic lists the variables that are used to define time formats in the eval functions strftime() and strptime() and for describing timestamps in event data.

Time variables

Variable Description
 %Ez Splunk specific, timezone in minutes.
 %H Hour (24-hour clock) as a decimal number, includes leading zeros. (00 to 23)
 %I Hour (12-hour clock), includes leading zeros. (01-12)
 %k Like %H, the hour (24-hour clock) as a decimal number; but a leading zero is replaced by a space. (0 to 23)
 %M Minute as a decimal number. (00 to 59)
 %N Subseconds with width. (%3N = milliseconds, %6N = microseconds, %9N = nanoseconds)
 %p AM or PM.
 %Q The subsecond component of 1970-01-01 00:00:00 UTC. (%3Q = milliseconds, %6Q = microseconds, %9Q = nanoseconds with values of 000-999)
 %S Second as a decimal number. (00 to 61)
 %s The Unix Epoch Time timestamp, or the number of seconds since the Epoch: 1970-01-01 00:00:00 +0000 (UTC). (1352395800 is Thu Nov 8 09:30:00 2012)
 %T The time in 24-hour notation (%H:%M:%S).
 %Z The timezone abbreviation. (EST for Eastern Time)
 %:z The timezone offset from UTC, in hour and minute: +hhmm or -hhmm. (-0500 for Eastern Time)
 %% A literal "%" character.

Date variables

Variable Description
 %F Equivalent to %Y-%m-%d (the ISO 8601 date format).

Specifying days

Variable Description
 %A Full weekday name. (Sunday, ..., Saturday)
 %a Abbreviated weekday name. (Sun, ... ,Sat)
 %d Day of the month as a decimal number, includes a leading zero. (01 to 31)
 %e Like %d, the day of the month as a decimal number, but a leading zero is replaced by a space. (1 to 31)
 %j Day of year as a decimal number, includes a leading zero. (001 to 366)
 %w Weekday as a decimal number. (0 = Sunday, ..., 6 = Saturday)

Specifying months

Variable Description
 %b Abbreviated month name. (Jan, Feb, etc.)
 %B Full month name. (January, February, etc.)
 %m Month as a decimal number. (01 to 12)

Specifying year

Variable Description
 %y Year as a decimal number, without the century. (00 to 99)
 %Y Year as a decimal number with century. (2012)


Time format string Result
 %Y-%m-%d 2012-12-31
 %y-%m-%d 12-12-31
 %b %d, %Y Feb 11, 2008
q|%d%b '%y = %Y-%m-%d| q|23 Apr '12 = 2012-04-23|
Functions for stats, chart, and timechart
Time modifiers for search

This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters