topic Issue with strptime in Splunk Search

Issue with strptime

efelder0 — Mon, 28 Sep 2020 11:38:53 GMT

I am trying to reformat a date field in Splunk. I have a field called "last_updated_date" and its value is 2012-04-03.

I am using the strptime command to reformat the field to the following: 04/03/12.
Here is my syntax:
eval last_updated_date=strftime(strptime(last_updated_date,"%Y-%b-%D"),"%M/%D/%Y")

However, it returns blank values in my output.

Thoughts?

Re: Issue with strptime

cvajs — Mon, 09 Apr 2012 15:30:47 GMT

you wrote "strftime"
is that the right command?
strftime takes (X) as epoch time and converts it to format Y

you dont have epoch time anywhere in your syntax. epoch is # of sec since jan 1 1970 00:00:00 UTC

http://docs.splunk.com/Documentation/Splunk/4.3.1/SearchReference/CommonEvalFunctions

Re: Issue with strptime

efelder0 — Mon, 09 Apr 2012 15:40:03 GMT

so, maybe strptime would not be useful in this scenario?

Re: Issue with strptime

efelder0 — Mon, 09 Apr 2012 15:41:10 GMT

I am looking to reformat the date to MM/DD/YYYY. Should this be done in props instead?

Re: Issue with strptime

cvajs — Mon, 09 Apr 2012 16:39:03 GMT

i think SEDCMD is a better route

Re: Issue with strptime

dwaddle — Mon, 09 Apr 2012 18:27:04 GMT

There's (at least) two ways of dealing with this. If you want to change the raw data within the event as it is being indexed then as cvajs suggested, SEDCMD is the route to take. It would look something like this:

[mysourcetype]
SEDCMD-date=s/\d{2}(\d{2})-(\d{2})-(\d{2})/\2\/\3\/\1/

(Assuming I got my sed syntax 100% correct)

Your strftime + strptime approach should work as well. It obviously does not change the data in the index, but it should update the field correctly. But, I think you have your format strings wrong:

... | eval last_updated_date=strftime(strptime(last_updated_date,"%Y-%m-%d"),"%m/%d/%y")