https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-only-give-strptime-output-for-one-of-three/m-p/207847#M60585 <P>Does this happen when you open the CSV in excel, or was the CSV saved from excel? Sometimes it does some weird auto-formatting stuff on dates ...<BR /> Do you just want to reformat it as YYYY-MM-DD?<BR /> If so, you could try just using the replace command instead of fieldformat:</P> <PRE><CODE>| replace "* 00:00:00.0" with "*" in DATE_OF_BIRTH </CODE></PRE> Thu, 03 Nov 2016 22:11:24 GMT lquinn 2016-11-03T22:11:24Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-only-give-strptime-output-for-one-of-three/m-p/207844#M60582 <P>I have a field DATE_OF_BIRTH and the values are like <BR /> 1962-09-30 00:00:00.0<BR /><BR /> 1955-10-21 00:00:00.0<BR /><BR /> 1988-10-31 00:00:00.0</P> <P>I am firing the below query,</P> <PRE><CODE>index=aimsprod source=accident splunk_server=alpputl018 *100172697* OR *100172679* | fieldformat dobtime=strptime(DATE_OF_BIRTH,"%Y-%m-%d %H:%M:%S") | table DATE_OF_BIRTH,dobtime </CODE></PRE> <P>The <STRONG>dobtime</STRONG> field only gives output for the value 1988-10-31 00:00:00.0.</P> <P>Why it does not give output for the other 2 above mentioned values?<IMG src="https://community.splunk.com/storage/temp/170221-untitled.png" alt="alt text" /></P> Tue, 29 Sep 2020 11:39:52 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-only-give-strptime-output-for-one-of-three/m-p/207844#M60582 ppanchal 2020-09-29T11:39:52Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-only-give-strptime-output-for-one-of-three/m-p/207845#M60583 <P>I believe it will be because epoch time is calculated as the number of seconds since 1st Jan 1970. The two dates that are not being converted occur before this time, so the value would be negative, which is not supported by Splunk. What are you trying to achieve by converting the timestamps to epoch?</P> <P>Might be worth taking a look at this answer:<BR /> <A href="https://answers.splunk.com/answers/214742/can-splunk-strptime-work-with-the-date-before-1970-1.html">https://answers.splunk.com/answers/214742/can-splunk-strptime-work-with-the-date-before-1970-1.html</A></P> Wed, 02 Nov 2016 21:59:24 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-only-give-strptime-output-for-one-of-three/m-p/207845#M60583 lquinn 2016-11-02T21:59:24Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-only-give-strptime-output-for-one-of-three/m-p/207846#M60584 <P>The issue that I am actually facing is when I export the data to a csv file, the date/time format is changed to something like 00:00:00...<BR /> Is there a way I an fix this?</P> Thu, 03 Nov 2016 13:53:02 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-only-give-strptime-output-for-one-of-three/m-p/207846#M60584 ppanchal 2016-11-03T13:53:02Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-only-give-strptime-output-for-one-of-three/m-p/207847#M60585 <P>Does this happen when you open the CSV in excel, or was the CSV saved from excel? Sometimes it does some weird auto-formatting stuff on dates ...<BR /> Do you just want to reformat it as YYYY-MM-DD?<BR /> If so, you could try just using the replace command instead of fieldformat:</P> <PRE><CODE>| replace "* 00:00:00.0" with "*" in DATE_OF_BIRTH </CODE></PRE> Thu, 03 Nov 2016 22:11:24 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-only-give-strptime-output-for-one-of-three/m-p/207847#M60585 lquinn 2016-11-03T22:11:24Z