https://community.splunk.com/t5/Splunk-Search/Please-use-Time-Variables-and-derive-strptime-time-variables-for/m-p/485172#M135778 <P>Some events have time as string as "Tue Jun 12 00:00:00 CDT 2018" and some have "Fri Nov 16 00:00:00 CST 2018" in ENDDATE field. Can data have different timezones in events? </P> <P>If yes I wrote strptime as eval "End Date"=strptime('ENDDATE',"%d %b %a %H:%M:%S %Z %Y"). It is not working. Please help.</P> Thu, 14 Nov 2019 15:07:02 GMT rajagurup 2019-11-14T15:07:02Z https://community.splunk.com/t5/Splunk-Search/Please-use-Time-Variables-and-derive-strptime-time-variables-for/m-p/485172#M135778 <P>Some events have time as string as "Tue Jun 12 00:00:00 CDT 2018" and some have "Fri Nov 16 00:00:00 CST 2018" in ENDDATE field. Can data have different timezones in events? </P> <P>If yes I wrote strptime as eval "End Date"=strptime('ENDDATE',"%d %b %a %H:%M:%S %Z %Y"). It is not working. Please help.</P> Thu, 14 Nov 2019 15:07:02 GMT https://community.splunk.com/t5/Splunk-Search/Please-use-Time-Variables-and-derive-strptime-time-variables-for/m-p/485172#M135778 rajagurup 2019-11-14T15:07:02Z https://community.splunk.com/t5/Splunk-Search/Please-use-Time-Variables-and-derive-strptime-time-variables-for/m-p/485173#M135779 <P>Yes, different timezones are allowed. CST and CDT are the same time zone, just adjusted for summer time (CST).</P> <P>Your time format string doesn't match your sample dates. Try <CODE>%a %b %d %H:%M:%S %Z %Y</CODE>.</P> Thu, 14 Nov 2019 15:39:27 GMT https://community.splunk.com/t5/Splunk-Search/Please-use-Time-Variables-and-derive-strptime-time-variables-for/m-p/485173#M135779 richgalloway 2019-11-14T15:39:27Z https://community.splunk.com/t5/Splunk-Search/Please-use-Time-Variables-and-derive-strptime-time-variables-for/m-p/485174#M135780 <P>Based on your sample, this should work for you</P> <PRE><CODE>| eval "End Date" = strptime(ENDDATE, "%a %b %e %T %Z %Y") </CODE></PRE> Thu, 14 Nov 2019 17:03:29 GMT https://community.splunk.com/t5/Splunk-Search/Please-use-Time-Variables-and-derive-strptime-time-variables-for/m-p/485174#M135780 arjunpkishore5 2019-11-14T17:03:29Z https://community.splunk.com/t5/Splunk-Search/Please-use-Time-Variables-and-derive-strptime-time-variables-for/m-p/485175#M135781 <P>Like this:</P> <PRE><CODE>| makeresults | eval ENDDATE="Tue Jun 12 00:00:00 CDT 2018" | fields - _time | eval "EndDate"=strptime(ENDDATE,"%a %b %d %H:%M:%S %Z %Y") </CODE></PRE> Fri, 15 Nov 2019 01:27:02 GMT https://community.splunk.com/t5/Splunk-Search/Please-use-Time-Variables-and-derive-strptime-time-variables-for/m-p/485175#M135781 woodcock 2019-11-15T01:27:02Z