topic Re: Difficult date time conversion in Splunk Search

Difficult date time conversion

timbitsandbytes — Fri, 18 Jan 2013 17:38:40 GMT

Well it's a difficult conversion for me, anyway.

Here's the field: dateTime=Fri Jan 18 17:11:55 GMT+00:00 2013

I want to convert it to seconds since the epoch so I can do a date comparison.
I don't think there's a way for Splunk to recognize the tz offset as "+00:00" so first I transform that to "+0000".

eval dtFormatted=replace(dateTime, ":", "") |
eval dtSeconds=strptime(dtFormatted, "%a %b %d %H%M%S %Z%:z %Y")

In my search results "dtFormatted" is discovered and I've verified it's properly formatted but "dtSeconds" is not discovered.

What am I doing wrong? Why can't I convert this string to seconds?

Re: Difficult date time conversion

jonuwz — Fri, 18 Jan 2013 18:08:02 GMT

Shouldn't you have dtFormatted as the 1st argument to strptime ?

Re: Difficult date time conversion

timbitsandbytes — Fri, 18 Jan 2013 18:26:02 GMT

Yes, thanks. Unfortunately when I copied the search string (on a network that doesn't have access to the Internet) I miscopied it. It's been corrected above.

Re: Difficult date time conversion

jonuwz — Sat, 19 Jan 2013 10:46:17 GMT

Try this :

... | rex mode=sed field=dateTime "s/(\+[0-9:]{5})/ \1/" 
    | eval dtSeconds=strptime(dateTime, "%a %b %d %T %Z %:z %Y")

The problem was that %Z expects a space after the time zone, In your format %Z was being set to GMT+0000 instead of GMT, and %Y was null.

Re: Difficult date time conversion

timbitsandbytes — Mon, 21 Jan 2013 15:11:30 GMT

I see - I would not have caught that. But your sed/regex works great. Thanks very much!