topic Re: Formatting String to Time returns nothing in Splunk Search

Formatting String to Time returns nothing

aelliott — Wed, 20 Nov 2013 17:12:09 GMT

Here is my query:
"TSStart"="2013-10-14T18:35:03.487" | eval MyTime=strptime(TSStart,"%Y-%m-%dT%T")

My Time Format for start time is in the format as above: 2013-10-14T18:35:03.487
The goal of this is to show the datetime in a format that is more readable, I want to first attempt to parse it into a timestamp format.
This is not the same field I am using for my Timestamp value as there is also a TSEnd within the data that I will need to format.

My query is not coming back with anything for "MyTime" and not throwing any errors in the logs.
Is my date format string incorrect? I have tried several variations and cannot get this to work.

Re: Formatting String to Time returns nothing

lukejadamec — Wed, 20 Nov 2013 17:48:24 GMT

Have you tried including the milliseconds?
"TSStart"="2013-10-14T18:35:03.487" | eval MyTime=strptime(TSStart,"%Y-%m-%dT%T.%f")

Re: Formatting String to Time returns nothing

aelliott — Wed, 20 Nov 2013 17:50:44 GMT

Yeah I've tried
strptime(TSStart,"%Y-%m-%dT%T.%3N") and seperating hour, minute, second as well.
I just tried the one you have there and it did not work either

Re: Formatting String to Time returns nothing

richgalloway — Wed, 20 Nov 2013 18:05:51 GMT

That works for me.

| eval TSStart="2013-10-14T18:35:03.487" | eval MyTime=strptime(TSStart,"%Y-%m-%dT%T") | eval MyTime2=strptime(TSStart,"%Y-%m-%dT%H:%M:%S.%3N") | table TSStart, MyTime, MyTime2

TSStart MyTime MyTime2
2013-10-14T18:35:03.487 1381790103.000000 1381790103.487000

Re: Formatting String to Time returns nothing

somesoni2 — Wed, 20 Nov 2013 18:06:49 GMT

I tried your search and its working for me. I see you want to get rid of milliseconds (otherwise the format is same). Can you try following: "TSStart"="2013-10-14T18:35:03.487" | eval MyTime=strptime(mvindex(split(TSStart,"."),0),"%Y-%m-%dT%T")

Re: Formatting String to Time returns nothing

aelliott — Wed, 20 Nov 2013 18:54:15 GMT

Ok I believe I have figured out this issue. I am using an XML type of Structure and the fields are auto mapped via the KV_MODE = xml. The Field is Actually Event.TSStart.
I did a rename on the field (| rename Event.TSStart as TSStart) and it started working.

I attempted first to surround Event.TSStart with Quotations, but it litterally put "Event.TSStart" in the formula.

I am not sure if this is a bug or intended.

Re: Formatting String to Time returns nothing

aelliott — Wed, 20 Nov 2013 19:16:32 GMT

Basically if your field has a . in it, the formulas fail, even trim