topic Re: Help on strftime in Getting Data In

Help on strftime

jip31 — Wed, 12 Jul 2023 09:23:47 GMT

I have a field time called LastLogonDate with this format

6/28/2023 1:47.35 PM

I want to format this field in a new field

So i am doing

| eval Last=strftime(LastLogonDate, "%d-%m-%y") but it doenst works

What is wrong please?

Re: Help on strftime

gcusello — Wed, 12 Jul 2023 09:34:09 GMT

Hi @jip31 ,

you have to operate two conversions:

| eval Last=strftime(strptime(LastLogonDate, "%m/%d/%Y %I:%H.%S %p"),"%d-%m-%y")

Only one beware: you used ":" betweeen hours and minutes and "." between minutes and seconds: is it an error or correct?

I followed your indication.

Ciao.

Giuseppe

Re: Help on strftime

jip31 — Wed, 12 Jul 2023 10:02:45 GMT

It's an error

I had : in your example between H and S

Your example wirks but only for some LadtLogonDate value but not for all

What is wrong please?

Re: Help on strftime

gcusello — Wed, 12 Jul 2023 10:15:12 GMT

Hi @jip31,

if you can confirm that the format is "6/28/2023 1:47:35 PM", it should be correct.

As I said, check the format of the separators between hours, minutes and seconds: if one is wrong, all the formula is wrong.

| eval Last=strftime(strptime(LastLogonDate, "%m/%d/%Y %I:%H:%S %p"),"%d-%m-%y")

Ciao.

Giuseppe

Re: Help on strftime

jip31 — Wed, 12 Jul 2023 10:46:24 GMT

It's strange because 7/3/2023 8:59:14 AM returns nothing while 1/18/2916 9:15:23 AM returns well 18-01-16 even if the forkat is the same...

Re: Help on strftime

gcusello — Wed, 12 Jul 2023 10:48:55 GMT

Hi @jip31,

the issue is in the day format, please try this:

| eval Last=strftime(strptime(LastLogonDate, "%m/%e/%Y %I:%H:%S %p"),"%d-%m-%y")

Ciao.

Giuseppe

Re: Help on strftime

jip31 — Wed, 12 Jul 2023 12:53:44 GMT

sorry but exactly the same issue

Re: Help on strftime

gcusello — Wed, 12 Jul 2023 14:38:32 GMT

Hi @jip31,

please try this:

| eval Last=strftime(strptime(LastLogonDate, "%x %I:%H:%S %p"),"%d-%m-%y")

Ciao.

Giuseppe

Re: Help on strftime

jip31 — Thu, 13 Jul 2023 08:11:04 GMT

it changes nothing

Re: Help on strftime

gcusello — Thu, 13 Jul 2023 09:41:01 GMT

Hi @jip31,

I don't know why it doesn't run, so, please try this workaround:

| rex field=LastLogonDate "^(?<month>\d+)\/(?<day>\d+)\/(?<year>\d+)" | eval day=if(day<10,"0".day,day), month=if(month<10,"0".month,month) | eval Last=day."/".month."/".year

that I tested.

Ciao.

Giuseppe

Re: Help on strftime

gcusello — Sat, 22 Jul 2023 05:50:55 GMT

Hi @jip31,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉