https://community.splunk.com/t5/Splunk-Search/How-come-strptime-does-not-work-for-some-days/m-p/453363#M128319 <P>There seems to be some issue with the strptime function. I'm not sure why it works for few days and does not work for few days.</P> <P>works </P> <PRE><CODE>index=_internal | eval Disconnect_Time="02/05/2019 08:22:40" | eval last_updated_date_epoch=strptime(Disconnect_Time,"%d/%m/%Y %H:%M:%S") | eval now=now() | eval diff=last_updated_date_epoch-now() | eval duration=diff/3600/24 | table Disconnect_Time,last_updated_date_epoch,now,diff,duration </CODE></PRE> <P>Does not work</P> <PRE><CODE>index=_internal | eval Disconnect_Time="02/13/2019 08:22:40" | eval last_updated_date_epoch=strptime(Disconnect_Time,"%d/%m/%Y %H:%M:%S") | eval now=now() | eval diff=last_updated_date_epoch-now() | eval duration=diff/3600/24 | table Disconnect_Time,last_updated_date_epoch,now,diff,duration </CODE></PRE> Fri, 22 Mar 2019 15:13:54 GMT shaileshmali 2019-03-22T15:13:54Z https://community.splunk.com/t5/Splunk-Search/How-come-strptime-does-not-work-for-some-days/m-p/453363#M128319 <P>There seems to be some issue with the strptime function. I'm not sure why it works for few days and does not work for few days.</P> <P>works </P> <PRE><CODE>index=_internal | eval Disconnect_Time="02/05/2019 08:22:40" | eval last_updated_date_epoch=strptime(Disconnect_Time,"%d/%m/%Y %H:%M:%S") | eval now=now() | eval diff=last_updated_date_epoch-now() | eval duration=diff/3600/24 | table Disconnect_Time,last_updated_date_epoch,now,diff,duration </CODE></PRE> <P>Does not work</P> <PRE><CODE>index=_internal | eval Disconnect_Time="02/13/2019 08:22:40" | eval last_updated_date_epoch=strptime(Disconnect_Time,"%d/%m/%Y %H:%M:%S") | eval now=now() | eval diff=last_updated_date_epoch-now() | eval duration=diff/3600/24 | table Disconnect_Time,last_updated_date_epoch,now,diff,duration </CODE></PRE> Fri, 22 Mar 2019 15:13:54 GMT https://community.splunk.com/t5/Splunk-Search/How-come-strptime-does-not-work-for-some-days/m-p/453363#M128319 shaileshmali 2019-03-22T15:13:54Z https://community.splunk.com/t5/Splunk-Search/How-come-strptime-does-not-work-for-some-days/m-p/453364#M128320 <P>Because 13 is not a valid month number <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> <P>Think you need to swap the %d and %m in your time format <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 22 Mar 2019 15:16:10 GMT https://community.splunk.com/t5/Splunk-Search/How-come-strptime-does-not-work-for-some-days/m-p/453364#M128320 FrankVl 2019-03-22T15:16:10Z