topic Re: Convert Format of apiStartTime to Epoch in Splunk Search

Convert Format of apiStartTime to Epoch

IRHM73 — Tue, 15 Mar 2016 07:43:25 GMT

Hi, I wonder whether someone may be able to help me please.

I'm trying to change the "apiStartTime" which is in the following format 'Sat Mar 5 00:00:00 2016' including the apostrophes to an epoch time so I can perform some date calculations.

So I've been looking at the Splunk documentation here and I thought I'd understood the variables I need to use and then convert and I put together the following:

|eval startTime=strptime(apiStartTime, "%a %m %d %H:%M:%S %Y")|convert timeformat="%d/%b/%Y" ctime(startTime)

Unfortunately though this isn't working, and I'm not sure why.

I just wondered whether someone could possibly look at this please and let me know where I've gone wrong.

Many thanks and kind regards

Chris

Re: Convert Format of apiStartTime to Epoch

richgalloway — Tue, 15 Mar 2016 11:50:38 GMT

The first half of your SPL correctly converts an apiStartTime string into epoch form. The second half converts the epoch back into a string, which may not be necessary, depending on why you need an epoch.

Re: Convert Format of apiStartTime to Epoch

IRHM73 — Tue, 15 Mar 2016 12:01:34 GMT

Hi, thank you for coming back to me with this and for the clarification on my query.

The problem is, is that in isolation this line

|eval startTime=strptime(apiStartTime, "%a %m %d %H:%M:%S %Y") isn't converting the api time to epoch.

Kind Regards

Chris

Re: Convert Format of apiStartTime to Epoch

richgalloway — Tue, 15 Mar 2016 12:08:44 GMT

If apiStartTime truly includes apostrophes, then the format string should be "'%a %m %d %H:%M:%S %Y'".

Re: Convert Format of apiStartTime to Epoch

IRHM73 — Tue, 15 Mar 2016 12:19:28 GMT

Hi, thank you for this. I just had to make a minor change to "'%a %m %b %H:%M:%S %Y'", which now works great.

In my initial testing I had incorporated a ' but with a % beforehand, because in the documentation it suggested to use something as a literal character add a % beforehand. I obviously misinterpreted this.

Once again thank you for your help and kind regards

Chris

Re: Convert Format of apiStartTime to Epoch

richgalloway — Tue, 15 Mar 2016 12:26:24 GMT

In strptime and strftime format strings, all characters are literal except those preceded by '%'. Use "%%" to get a literal '%'.

Re: Convert Format of apiStartTime to Epoch

IRHM73 — Tue, 15 Mar 2016 12:29:57 GMT

Ahh I see.

That's a lot clearer now. Thank you.

Re: Convert Format of apiStartTime to Epoch

nvanderwalt_spl — Mon, 26 Mar 2018 05:44:58 GMT

This is reviving a very old thread, but I will still post this in case someone else needs it. Try:

|eval startTime=strptime('apiStartTime', "'%a %b %e %H:%M:%S %Y'")