> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/parse_timestamp.md).

# parse\_timestamp

**Syntax**

```programlisting
parse_timestamp("<format time string>", "<time string>" | format_string(<time field>) | <time string field>)
```

```programlisting
parse_timestamp("<format time string>", "<time string>" | format_string(<time field>) | <time string field>, "<time zone>")
```

**Description**

The `parse_timestamp()` function returns a TIMESTAMP object after converting a string representation of a timestamp. The `<time zone>` offset is optional to configure using an hours offset, such as “+08:00”, or using a time zone name from the [List of Supported Time Zones](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones), such as "America/Chicago". The `parse_timestamp()` function can include both an [alter](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/alter.md) stage and [format\_string](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/format_string.md) function. For more information, see the examples below. The `format_string` function contains the format elements that define how the `parse_timestamp` string is formatted. Each element in the `parse_timestamp` string must have a corresponding element in `format_string`. The location of each element in the `format_string` must match the location of each element in `parse_timestamp`.

**Examples**

* **Without a time zone configured**

  Returns a maximum of 100 `microsoft_dhcp_raw` records, which includes a TIMESTAMP object in the `p_t_test` field in the format MMM dd YYYY HH:flag\_mm:ss, such as Jun 25th 2021 18:31:25. This format is detailed in the `format_string` function, which includes merging both the `date` and `time` fields.

  ```programlisting
  dataset = microsoft_dhcp_raw 
  | alter p_t_test = parse_timestamp("%m/%d/%Y %H:%M:%S", format_string("%s %s", date, time)) 
  | fields p_t_test 
  | limit 100
  ```
* **With a time zone name configured**

  Returns a maximum of 100 `microsoft_dhcp_raw` records, which includes a TIMESTAMP object in the `p_t_test` field in the format MMM dd YYYY HH:flag\_mm:ss, such as Jun 25th 2021 18:31:25. This format is detailed in the `format_string` function, which includes merging both the `date` and `time` fields, and includes a "Asia/Singapore" time zone.

  ```programlisting
  dataset = microsoft_dhcp_raw 
  | alter p_t_test = parse_timestamp("%m/%d/%Y %H:%M:%S", format_string("%s %s", date, time), "Asia/Singapore") 
  | fields p_t_test 
  | limit 100
  ```
* **With a time zone configured using an hours offset**

  Returns a maximum of 100 `microsoft_dhcp_raw` records, which includes a TIMESTAMP object in the `p_t_test` field in the format MMM dd YYYY HH:flag\_mm:ss, such as Jun 25th 2021 18:31:25. This format is detailed in the `format_string` function, which includes merging both the `date` and `time` fields, and includes a time zone using an hours offset of “+08:00”.

  ```programlisting
  dataset = microsoft_dhcp_raw 
  | alter p_t_test = parse_timestamp("%m/%d/%Y %H:%M:%S", format_string("%s %s", date, time), "+08:00") 
  | fields p_t_test 
  | limit 100
  ```
* **Convert a time string that contains milliseconds**

  Returns a single `xdr_data` record, which includes both, a manually added time string, "Jun 25 2024 18:31:25.723", in the `time_string` field and a TIMESTAMP object in the `p_t_test` field, such as Jun 25 2024 18:31:25, as the result of the `parse_timestamp()` function. Notice that the format element `%E*S` is used to capture seconds including any level of factional precision, such as milliseconds.

  ```programlisting
  dataset = xdr_data  
  | limit 1
  | alter time_string = "Jun 25 2024 18:31:25.723"
  | alter p_t_test = parse_timestamp("%h %d %Y %H:%M:%E3S", time_string) 
  | fields p_t_test, time_string  
  ```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/parse_timestamp.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.