Convert time in CSV upload

vulnfree — Fri, 29 Nov 2019 17:30:49 GMT

I have a CSV file uploaded via "lookup Editor" and my "Scan Date" column has the following time format:

11/19/2019 11:13:53 AM

I want Splunk to recognize this time format for me to tell it to display everything older than 7 days from now.
First step was to change it to epoch to then change to 11/19/2019 format, excluding the hour, minutes and seconds.

| eval "epoch"= strptime("Scan Date","%m/%d/%Y %I:%M:%S %p")

But I don't see anything when I:

table "epoch"

What am I missing?

Re: Convert time in CSV upload

woodcock — Fri, 29 Nov 2019 19:34:50 GMT

For field names in that position/operation, you need to use ' or $, like this:

| inputlookup YourCsvFileHere.csv
| eval _time= strptime('Scan Date', "%m/%d/%Y %I:%M:%S %p")
| addinfo
| replace "+Infinity" WITH "9999999999" IN info_max_time
| rename info_* AS _info_*
| where _time >= _info_min_time AND _time <= _info_max_time

But fields with spaces are EVIL so you could avoid all of that by doing:

| inputlookup YourCsvFileHere.csv
| rename "* *" AS *_*
| eval _time= strptime(Scan_Date, "%m/%d/%Y %I:%M:%S %p")
| addinfo
| replace "+Infinity" WITH "9999999999" IN info_max_time
| rename info_* AS _info_*
| where _time >= _info_min_time AND _time <= _info_max_time

topic Re: Convert time in CSV upload in Getting Data In

Convert time in CSV upload

Re: Convert time in CSV upload