https://community.splunk.com/t5/Splunk-Search/Strptime-bug/m-p/26580#M5148 <P>Has anyone else noticed that strptime does not work in the following situation?</P> <P>VersionExpiry has a value of <STRONG>9999-01-01 00:00:00</STRONG> (or with any year greater than 2999)</P> <P>eval VersionExpiryEpoch=strptime(VersionExpiry, "%Y-%m-%d %H:%M:%S")</P> <P>Field "VersionExpiryEpoch" is never created</P> <HR /> <P>Does anyone have any workaround ideas to force Splunk in recognizing that existence may, in fact, continue past the year 2999? <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> <P>The raw data Splunk is receiving is indicating that the version, as of this moment, does not have an expiration date... hence the year 9999. I could, easily, hardcode it in the query that a value of 9999-01-01 00:00:00 means that the version is up to date, but I'd prefer that the function worked correctly.</P> Wed, 07 Nov 2012 16:44:05 GMT ARothman 2012-11-07T16:44:05Z https://community.splunk.com/t5/Splunk-Search/Strptime-bug/m-p/26580#M5148 <P>Has anyone else noticed that strptime does not work in the following situation?</P> <P>VersionExpiry has a value of <STRONG>9999-01-01 00:00:00</STRONG> (or with any year greater than 2999)</P> <P>eval VersionExpiryEpoch=strptime(VersionExpiry, "%Y-%m-%d %H:%M:%S")</P> <P>Field "VersionExpiryEpoch" is never created</P> <HR /> <P>Does anyone have any workaround ideas to force Splunk in recognizing that existence may, in fact, continue past the year 2999? <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> <P>The raw data Splunk is receiving is indicating that the version, as of this moment, does not have an expiration date... hence the year 9999. I could, easily, hardcode it in the query that a value of 9999-01-01 00:00:00 means that the version is up to date, but I'd prefer that the function worked correctly.</P> Wed, 07 Nov 2012 16:44:05 GMT https://community.splunk.com/t5/Splunk-Search/Strptime-bug/m-p/26580#M5148 ARothman 2012-11-07T16:44:05Z https://community.splunk.com/t5/Splunk-Search/Strptime-bug/m-p/26581#M5149 <P>If you just need it to work on that specific far future date, then you could do something like this:</P> <P><CODE>search goes here | eval VersionExpiryEpoch = coalesce(strptime(VersionExpiry, "%Y-%m-%d %H:%M:%S"), 253370786400)</CODE></P> Thu, 08 Nov 2012 16:33:39 GMT https://community.splunk.com/t5/Splunk-Search/Strptime-bug/m-p/26581#M5149 dart 2012-11-08T16:33:39Z https://community.splunk.com/t5/Splunk-Search/Strptime-bug/m-p/26582#M5150 <P>Seems to have done the trick - thanks.</P> Thu, 08 Nov 2012 17:34:40 GMT https://community.splunk.com/t5/Splunk-Search/Strptime-bug/m-p/26582#M5150 ARothman 2012-11-08T17:34:40Z