https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/unable-to-parse-the-time-stamp/m-p/606916#M7348 <P>I have trying to create a new field with existing string field (cretedDate) which is already in a ISO 8601 format but. unable to parse it<BR /><BR />sample value of feild createdDate=<SPAN>2019-08-29T10:10:26.608Z</SPAN></P> <DIV class="ag-cell-value ag-cell ag-cell-not-inline-editing ag-cell-normal-height" tabindex="-1" role="gridcell" aria-colindex="24"> <DIV class="secdo-cell-container ng-star-inserted">&nbsp;</DIV> </DIV> <P><BR /><BR /></P> <P>here below the query i have used <BR /><BR /><BR />| alter filedate = parse_timestamp("%Y-%m-%dT%H:%M:%S.%fZ", createdDate)<BR /><BR /><BR />Anybody help me to sort this out</P> <P>&nbsp;</P> <P><LI-PRODUCT title="Cortex XSIAM" id="Cortex_XSIAM"></LI-PRODUCT>&nbsp;<LI-PRODUCT title="Cortex XDR" id="Cortex_XDR"></LI-PRODUCT>&nbsp;<BR /><BR /></P> Fri, 18 Oct 2024 16:27:33 GMT SUDHAKARVEL 2024-10-18T16:27:33Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/unable-to-parse-the-time-stamp/m-p/606916#M7348 <P>I have trying to create a new field with existing string field (cretedDate) which is already in a ISO 8601 format but. unable to parse it<BR /><BR />sample value of feild createdDate=<SPAN>2019-08-29T10:10:26.608Z</SPAN></P> <DIV class="ag-cell-value ag-cell ag-cell-not-inline-editing ag-cell-normal-height" tabindex="-1" role="gridcell" aria-colindex="24"> <DIV class="secdo-cell-container ng-star-inserted">&nbsp;</DIV> </DIV> <P><BR /><BR /></P> <P>here below the query i have used <BR /><BR /><BR />| alter filedate = parse_timestamp("%Y-%m-%dT%H:%M:%S.%fZ", createdDate)<BR /><BR /><BR />Anybody help me to sort this out</P> <P>&nbsp;</P> <P><LI-PRODUCT title="Cortex XSIAM" id="Cortex_XSIAM"></LI-PRODUCT>&nbsp;<LI-PRODUCT title="Cortex XDR" id="Cortex_XDR"></LI-PRODUCT>&nbsp;<BR /><BR /></P> Fri, 18 Oct 2024 16:27:33 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/unable-to-parse-the-time-stamp/m-p/606916#M7348 SUDHAKARVEL 2024-10-18T16:27:33Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/unable-to-parse-the-time-stamp/m-p/610146#M7362 <P>Hi&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/215447">@SUDHAKARVEL</a>, thanks for reaching us using the Live Community.</P> <P>&nbsp;</P> <P>Please take a look at the parse_timestamp documentation here:&nbsp;<A href="https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/parse_timestamp" target="_blank">https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/parse_timestamp</A></P> <P>Looks like you are missing the&nbsp;format_string function.</P> <P>&nbsp;</P> <P>If this post answers your question, please mark it as the solution.</P> Mon, 21 Oct 2024 15:35:22 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/unable-to-parse-the-time-stamp/m-p/610146#M7362 jmazzeo 2024-10-21T15:35:22Z