topic Re: Date type issue on extracted fields in Splunk Search

Date type issue on extracted fields

clementros — Wed, 30 Sep 2020 03:15:41 GMT

Hi all,

I have two date fields extracted (with regex) from log files.

starting_collection_timestamp = Thu Oct 17 22:40:10 GMT 2019
end_collection_timestamp = Thu Oct 17 22:40:21 GMT 2019

I tried to know the exact type for this fields with the command :

| makeresults | eval t=typeof(starting_collection_timestamp)

Here is the result :

        _time              |            t
 2019-11-29 08:56:43                 Invalid

When i tried to calculate the elapsed time between starting_collection_timestamp and end_collection_timestamp i have an empty field.

I tried to change the type with the command strptime without sucess.

| eval strptime('starting_collection_timestamp', "%a %b %d %H:%M:%S %Z %Y")

Thank you for your help.

Re: Date type issue on extracted fields

kamlesh_vaghela — Thu, 05 Dec 2019 09:27:18 GMT

@clementros

I think you should try this.

| makeresults 
| eval starting_collection_timestamp="Thu Oct 17 22:40:10 GMT 2019", end_collection_timestamp="Thu Oct 17 22:40:21 GMT 2019" 
| eval starting_collection_timestamp = strptime('starting_collection_timestamp', "%a %b %d %H:%M:%S %Z %Y") 
| eval end_collection_timestamp = strptime('end_collection_timestamp', "%a %b %d %H:%M:%S %Z %Y") 
| eval total_duration = end_collection_timestamp - starting_collection_timestamp 
| eval duration = tostring(total_duration, "duration")

Re: Date type issue on extracted fields

clementros — Thu, 05 Dec 2019 11:02:46 GMT

Thank you it works

Re: Date type issue on extracted fields

kamlesh_vaghela — Thu, 05 Dec 2019 11:13:31 GMT

Great @clementros. Please upvote and accept this answer to close this question.