topic Re: Strptime() Eval command returning empty in Splunk Search

Strptime() Eval command returning empty

olawalePS — Mon, 06 Nov 2023 10:59:58 GMT

What is wrong with the query below, it does not return any value in the timestamp field. The attached image shows a result sample

index="jamf" sourcetype="jssUapiComputer:computerGeneral" | dedup computer_meta.serial | eval timestamp = strptime(computerGeneral.lastEnrolledDate, "%Y-%m-%dT%H:%M:%S.%3QZ") | eval sixtyDaysAgo = relative_time(now(), "-60d") | table computer_meta.name, computerGeneral.lastEnrolledDate,timestamp, sixtyDaysAgo

Screenshot 2023-11-06 at 11.54.31.png

Re: Strptime() Eval command returning empty

gcusello — Mon, 06 Nov 2023 11:03:00 GMT

Hi @olawalePS,

try to rename the field:

index="jamf" sourcetype="jssUapiComputer:computerGeneral" | dedup computer_meta.serial | rename computerGeneral.lastEnrolledDate AS lastEnrolledDate | eval timestamp = strptime(lastEnrolledDate, "%Y-%m-%dT%H:%M:%S.%3QZ") | eval sixtyDaysAgo = relative_time(now(), "-60d") | table computer_meta.name, lastEnrolledDate,timestamp, sixtyDaysAgo

or using quotes (').

ciao.

Giuseppe

Re: Strptime() Eval command returning empty

olawalePS — Mon, 06 Nov 2023 11:17:58 GMT

Thanks, it works, but do you know why it did not work previously, there is no space in the "computerGeneral.lastEnrolledDate" field

Re: Strptime() Eval command returning empty

gcusello — Mon, 06 Nov 2023 11:20:33 GMT

Hi @olawalePS,

dot is a special char and sometimes requires the quotes or the rename.

Anyway, good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉