topic Re: extract date with characters between in Getting Data In

extract date with characters between

sbsbb — Tue, 22 Jan 2013 10:04:10 GMT

I try to transform a date string, into a date, to enable splunk to sort it.

Here is a sample :
2013-01-17T09:35:49Z

Hi tried :
eval n=strftime(field, " %Y-%m-%dT%H:%M:%SZ")

But it doesn't work. Why ? What would be the best way to do this ?
Is there a way to automate the conversion at searchtime ?

Re: extract date with characters between

Damien_Dallimor — Mon, 28 Sep 2020 13:09:30 GMT

If I understand correctly you want to parse the string "2013-01-17T09:35:49Z" into a time value , so you should use str*ptime not strf*time

Re: extract date with characters between

sbsbb — Tue, 22 Jan 2013 11:10:04 GMT

Ok, thanks, but
eval n=strptime(field, " %Y-%m-%dT%H:%M:%SZ")
still returns no value

Re: extract date with characters between

Damien_Dallimor — Tue, 22 Jan 2013 11:18:38 GMT

This worked fine for me, I think you have an accidental space character before the "%Y" :

...| eval foo="2013-01-17T09:35:49Z" | eval goo=strptime(foo,"%Y-%m-%dT%H:%M:%SZ") | table goo

Re: extract date with characters between

sbsbb — Tue, 22 Jan 2013 11:22:07 GMT

It was because of a leading space character... it works now, thanks

Re: extract date with characters between

sbsbb — Fri, 15 Aug 2014 08:51:58 GMT

At index Time, splunk is able to reconize Timeformat automatically, is there a way to use the same recognition an search time, with "convert" for example ?

I have 4 different Timeformat for the same field, and I want to be able to convert it in one way...:
2014-08-15T10:13:00+02:00
2014-08-15T10:13:00.000+02:00
2014-08-15T08:41:36Z
2014-08-15T08:41:36.000Z

if I use
| convert auto()

I only get the year...
But somehow Splunk is able to handle this by indexing, maybe a function is missing being able to use it a search time ?