topic Re: How do you use strptime with different date formats? in Splunk Search

How do you use strptime with different date formats?

JoshuaJohn — Mon, 05 Nov 2018 16:31:05 GMT

I have two date formats coming into my index (01/11/2018) and (01/11/18). I wrote:

| eval LastSeen_epoch = strptime('LastSeen', "%m/%d/%Y %H:%M"),strptime('LastSeen', "%m/%d/%y %H:%M")

However, this does not work to convert both types that are coming in. (Y and y) are the differences.

Any ideas?

Re: How do you use strptime with different date formats?

Vijeta — Mon, 05 Nov 2018 17:37:03 GMT

Check the length of your "Last_date" field using len() function, if length is 8 then use %y format else if length is 10 use %Y format. Let me know if you need help forming the query.

Re: How do you use strptime with different date formats?

t_hartmann — Wed, 02 Jan 2019 13:20:13 GMT

Try wrapping your strptime calls in coalsece like this:

eval LastSeen_epoch = coalesce(strptime('LastSeen', "%m/%d/%Y %H:%M"),strptime('LastSeen', "%m/%d/%y %H:%M"))

This should return the epoch time for the first format which can be successfully used to parse LastSeen.