topic Re: strptime conversion difficulty from a string in Splunk Search

strptime conversion difficulty from a string

mdurdel — Wed, 30 Sep 2020 02:56:11 GMT

Hello,

I am having difficulty getting the strptime function to properly convert my date string into a usable and accurate time stamp. Here is an example of the string and the strptime function I have tried. Can you help with the proper conversion please?

string=05-NOV-19 10.53.49.287000 AM AMERICA/CHICAGO

This did not work: | eval first_res_time = strptime(previous_resolution_time, "%d/%B/%y %H/%M/%S/%N")

Thank you,

-MD

Re: strptime conversion difficulty from a string

richgalloway — Mon, 11 Nov 2019 16:27:16 GMT

That strptime format string doesn't match the data. Try %-%b-%y %h.%M.%S.%6N %p %Z. I'm not sure Splunk will recognize "AMERICA/CHICAGO" as time zone identifier, though.

Re: strptime conversion difficulty from a string

mayurr98 — Mon, 11 Nov 2019 17:23:37 GMT

Try this:

| makeresults 
| eval string="05-NOV-19 10.53.49.287000 AM AMERICA/CHICAGO" 
| eval first_res_time=strptime(string, "%d-%b-%y %I.%M.%S.%6N %p")

For timezone, you may need to make changes in the props.conf:

TZ=America/Chicago

Refer https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
Splunk docs https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/Applytimezoneoffsetstotimestamps

Re: strptime conversion difficulty from a string

mdurdel — Mon, 11 Nov 2019 18:19:47 GMT

Thank you @mayurr98