https://community.splunk.com/t5/Splunk-Search/Issue-with-strptime/m-p/212499#M62249 <P>Worked! Thank you for the great explanation!</P> Fri, 23 Sep 2016 20:27:31 GMT singhh4 2016-09-23T20:27:31Z https://community.splunk.com/t5/Splunk-Search/Issue-with-strptime/m-p/212495#M62245 <P>Hey guys,</P> <P>So I've used strptime before but for some reason this isn't working properly. I have a column with different types of data like below:</P> <PRE><CODE>Column |Value ------------------ 02/2016 | 100 03/2016 | 200 04/2016 | 150 05/2016 | 450 high | 12 medium | 30 low | 34 </CODE></PRE> <P>I have a column that separates the dates from the rest. so with that me search s simple:</P> <PRE><CODE>index="servers" filter="dates" | eval myDate = strptime(Column, "%m/%Y")|table myDate </CODE></PRE> <P>"filter" would be the field thats used separate the date from other data. This search gives me nothing. <BR /> What would the problem and how would i get it to work? </P> <P>Thanks in advanced!</P> Fri, 23 Sep 2016 19:59:25 GMT https://community.splunk.com/t5/Splunk-Search/Issue-with-strptime/m-p/212495#M62245 singhh4 2016-09-23T19:59:25Z https://community.splunk.com/t5/Splunk-Search/Issue-with-strptime/m-p/212496#M62246 <P>The screen shot has a "Column" field, but the SPL has "Columns". Parsing a column that doesn't exist will yield nothing.</P> Fri, 23 Sep 2016 20:04:00 GMT https://community.splunk.com/t5/Splunk-Search/Issue-with-strptime/m-p/212496#M62246 richgalloway 2016-09-23T20:04:00Z https://community.splunk.com/t5/Splunk-Search/Issue-with-strptime/m-p/212497#M62247 <P>Just an error when asking question. Fixed but the issue is still the same. Sorry about that</P> Fri, 23 Sep 2016 20:06:54 GMT https://community.splunk.com/t5/Splunk-Search/Issue-with-strptime/m-p/212497#M62247 singhh4 2016-09-23T20:06:54Z https://community.splunk.com/t5/Splunk-Search/Issue-with-strptime/m-p/212498#M62248 <P>The issue here is that strptime need both date and month to parse a string formated date to epoch. Year is optional. Your data doesn't have date part, hence strptime fails. </P> <P>Option: add date part explicitly (when using month you anyways refer to first date of the month).</P> <PRE><CODE> index="servers" filter="dates" | eval myDate = strptime("01/".Columns, "%d/%m/%Y")|table myDate </CODE></PRE> Fri, 23 Sep 2016 20:20:15 GMT https://community.splunk.com/t5/Splunk-Search/Issue-with-strptime/m-p/212498#M62248 somesoni2 2016-09-23T20:20:15Z https://community.splunk.com/t5/Splunk-Search/Issue-with-strptime/m-p/212499#M62249 <P>Worked! Thank you for the great explanation!</P> Fri, 23 Sep 2016 20:27:31 GMT https://community.splunk.com/t5/Splunk-Search/Issue-with-strptime/m-p/212499#M62249 singhh4 2016-09-23T20:27:31Z https://community.splunk.com/t5/Splunk-Search/Issue-with-strptime/m-p/212500#M62250 <P>+1, Somesoni Sir. </P> <P>One question - <BR /> ///Option: add date part explicitly (when using month you anyways refer to first date of the month).///<BR /> why refer to first date, when using month?!?</P> Fri, 23 Sep 2016 20:52:02 GMT https://community.splunk.com/t5/Splunk-Search/Issue-with-strptime/m-p/212500#M62250 inventsekar 2016-09-23T20:52:02Z https://community.splunk.com/t5/Splunk-Search/Issue-with-strptime/m-p/212501#M62251 <P>Take the reference of the timechart with span=1mon. All the _time value will be set to "01/Month/Year 00:00:00 AM". While bucketing Splunk assigns lower value to the bucket, for month it'll be first day.</P> Fri, 23 Sep 2016 20:54:58 GMT https://community.splunk.com/t5/Splunk-Search/Issue-with-strptime/m-p/212501#M62251 somesoni2 2016-09-23T20:54:58Z