Answer by warren for Splunk: Extract string and convert it to date format

Check out strftime.org, and the related strptime function used with eval

Something on the order of this (pulled the microseconds out of your rex, since Unix epoch time has no concept of subsecond intervals):

| rex field=_raw "timeStamp\>(?<timeStamp>[^\.]+)\.\d+Z"
| eval unixepoch=strptime(timeStamp,"%Y-%m-%dT%H:%M:%S")

from User warren – Stack Overflow https://stackoverflow.com/questions/70802593/splunk-extract-string-and-convert-it-to-date-format/70803673#70803673
via IFTTT