Splunk: Extract string and convert it to date format

Solution 1:

There's nothing special about those timestamps - they're in standard form. Use the strptime function to convert them.

index = something 
|rex field=_raw "id>(?<Id>[^\<]+)" 
|rex "timeStamp>(?<timeStamp>[^\<]+)"
| eval ts = strptime(timeStamp, "%Y-%m-%dT%H:%M:%S.%3N%Z")
| eval diff = ts - _time
| table _time Id timeStamp diff

Solution 2:

Check out strftime.org, and the related strptime function used with eval

Something on the order of this (pulled the microseconds out of your rex, since Unix epoch time has no concept of subsecond intervals):

| rex field=_raw "timeStamp\>(?<timeStamp>[^\.]+)\.\d+Z"
| eval unixepoch=strptime(timeStamp,"%Y-%m-%dT%H:%M:%S")