Skip to main content
Sumo Logic

parseDate

  1. Last updated
  2. Save as PDF

The parseDate operator extracts a date or time from a string and provides a timestamp in milliseconds.

Syntax

  • parseDate(<strDate>, <dateFormat>)
  • parseDate(<strDate>, <dateFormat>, <timeZone>)

If you do not supply timeZone, the date returned is Pacific Standard Time (PST). For a list of timeZone codes, see https://en.wikipedia.org/wiki/List_of_tz_database_time_zones.

Rules

  • strDate must start with the characters to match with the dateFormat pattern. For example, "3/4/2005 other" but not "other 3/4/2005".
  • dateFormat is a pattern string, such as "MM/dd/yyyy HH:mm:ss a". For 
    more details about specifying the dateFormat see Timestamps, Time Zones, Time Ranges, and Date Formats.
  • A full list of the supported patterns can be found on Java's simpledateformat documentation.

Example

Given a log message such as:

instance of Win32_NTLogEvent
{
	EventIdentifier = 100;
	Logfile = "Application";
	RecordNumber = 894528;
	SourceName = "Bonjour Service";
	TimeGenerated = "20170720000030.000000-000";
	TimeWritten = "20170720000030.000000-000";
	Type = "Error";
    ...

The following query returns TimeGenerated as a timestamp in milliseconds, in this example 1500534030000.

| parse "TimeGenerated = \"*.000000-000" as dd
| parseDate(dd, "yyyyMMddHHmmss") as milliseconds

To specify a time zone:

| parseDate(dd, "yyyyMMddHHmmss", "etc/utc") as milliseconds

See Also