Date and time format variables
%m-%d%Y %l:%M:%S %p
05-31-2021 02:45:37 PM
%m-%d-%Y %H:%M:%S.%l
05-31-2021 09:45:22.798
%m-%d-%Y %H:%M:%S.%l %z
05-31-2021 09:45:22.798 -0700
%m-%d-%Y %l:%M:%S %p
05-31-2021 09:45:37 AM
%Y-%m-%dT %H:%M:%S.%QZ
2021-05-31T 09:45:22.798Z
%Y-%m-%dT %H:%M:%S.%Z
2021-05-31T 09:45:22.PDT
%Y-%m-%dT%T
2021-05-31T09:45:22
%Y-%m-%dT%H:%M:%S.%Q
2021-05-31T09:45:22.798
%Y-%m-%dT%H:%M:%S
2021-05-31T14:45:37.798
%Y-%m-%dT%H:%M:%S.%QZ
2021-05-31T14:45:37.798Z
%d/%b/%Y:%H:%M:%S.%f %z
31/May/2021:09:45:22.798000 -0700
%%
A literal "%" character.
%p
AM or PM
%b
Abbreviated month name. (Jan, Feb, etc.)
%a
Abbreviated weekday name. (Sun, ... ,Sat)
%d
Day of the month as a decimal number, includes a leading zero. (01 to 31)
%j
Day of year as a decimal number, includes a leading zero. (001 to 366)
%F
Equivalent to %Y-%m-%d (the ISO 8601 date format).
%B
Full month name. (January, February, etc.)
%A
Full weekday name. (Sunday, ..., Saturday)
%I
Hour (12-hour clock) with the hours represented by the values 01 to 12. Leading zeros are accepted but not required.
%H
Hour (24-hour clock) as a decimal number. Hours are represented by the values 00 to 23. Leading zeros are accepted but not required.
%k
Like %H, the hour (24-hour clock) as a decimal number. Leading zeros are replaced by a space, for example 0 to 23.
%e
Like %d, the day of the month as a decimal number, but a leading zero is replaced by a space. (1 to 31)
%b %d, %Y %l:%M:%S %p
May 31, 2021 02:45:37 PM
%f
Microseconds as a decimal number.
%M
Minute as a decimal number. Minutes are represented by the values 00 to 59. Leading zeros are accepted but not required.
%m
Month as a decimal number. (01 to 12). Leading zeros are accepted but not required.
%S
Second as a decimal number, for example 00 to 59.
%Ez
Splunk-specific, timezone in minutes.
%s
The Unix Epoch Time timestamp, or the number of seconds since the Epoch: 1970-01-01 00:00:00 +0000 (UTC). (1484993700 is Tue Jan 21 10:15:00 2020)
%c
The date and time in the current locale's format as defined by the server's operating system. For example, Thu Jul 18 09:30:00 2019 for US English on Linux.
%+
The date and time with time zone in the current locale's format as defined by the server's operating system. For example, Thu Jul 18 09:30:00 PDT 2019 for US English on Linux.
%x
The date in the format of the current locale. For example, 7/13/2019 for US English.
%N
The number of subsecond digits. The default is %9N. You can specify %3N = milliseconds, %6N = microseconds, %9N = nanoseconds.
%Q
The subsecond component of a UTC timestamp. The default is milliseconds, %3Q. Valid values are: %3Q = milliseconds, with values of 000-999 %6Q = microseconds, with values of 000000-999999 %9Q = nanoseconds, with values of 000000000-999999999
%T
The time in 24-hour notation (%H:%M:%S). For example 23:59:59.
%X
The time in the format for the current locale. For US English the format for 9:30 AM is 9:30:00.
%Z
The timezone abbreviation. For example EST for US Eastern Standard Time.
%z
The timezone offset from UTC, in hour and minute: +hhmm or -hhmm. For example, for 5 hours before UTC the values is -0500 which is US Eastern Standard Time. Examples: Use %z to specify hour and minute, for example -0500 Use %:z to specify hour and minute separated by a colon, for example -5:00 Use %::z to specify hour minute and second separated with colons, for example -05:00:00 Use %:::z to specify hour only, for example -05
%V (or %U)
Week of the year. The %V variable starts the count at 1, which is the most common start number. The %U variable starts the count at 0.
%w
Weekday as a decimal number. (0 = Sunday, ..., 6 = Saturday)
%y
Year as a decimal number, without the century. (00 to 99). Leading zeros are accepted but not required.
