Date time formatting variables not producing result I expected

pgoldweic — Thu, 26 Oct 2023 22:23:03 GMT

Hi, I have an existing search as follows:

| eval tempTime=strptime(due_at."-0000","%Y-%m-%d %H:%M:%S.%3N%z")
| eval dueDateCompact = strftime(tempTime, "%m-%d-%y")

which I have used to successfully convert a string field ('due_at') representing an UTC value (although formatted without the time-zone designation at the end), to an abbreviated notation (month-day-year) displayed in local time. So, for example, if "due_at" has a value of "2023-09-30 04:59:59.000", then the resulting "dueDateCompact" field ends up with "09-29-23" in there, correctly representing "due_at" but in Chicago local time (5 hours behind UTC).
However, my current requirements are such that "due_at" comes formatted as "2023-09-30T04:59:59.000Z" (iso 8601 proper) instead of the original "2023-09-30 04:59:59.000" (note: only the intermediate T and ending Z are the differences between original and updated formats).

Therefore, I updated the first part of my original search to read:

| eval tempTime=strptime(due_at,"%Y-%m-%d %H:%M:%S.%3QZ")

(so I am not appending '-0000' anymore to "due_at", since the 'Z' is present in the format string)

but this is NOT producing the correct local time in 'dueDateCompact' anymore (it produces "09-30-23" instead of "09-29-23").

Is there a logical explanation for this?

Re: Date time formatting variables not producing result I expected

yuanliu — Fri, 27 Oct 2023 07:32:15 GMT

The letter Z at the end of 2023-09-30T04:59:59.000Z signifies Zulu time. (Zulu equals UTC for practical purposes.) All you need to do is strptime(due_at, "%Y-%m-%d %H:%M:%S.%3N%Z").

Re: Date time formatting variables not producing result I expected

pgoldweic — Fri, 27 Oct 2023 15:46:53 GMT

Thanks @yuanliu ! That definitely does it. I was sure I had tried this already, but somehow, I seem to have missed that particular format string and was skipping the percent before the Z. Thanks again for replying!

topic Re: Date time formatting variables not producing result I expected in Splunk Search

Date time formatting variables not producing result I expected

Re: Date time formatting variables not producing result I expected

Re: Date time formatting variables not producing result I expected