https://community.splunk.com/t5/Splunk-Search/Unable-to-match-field-with-strptime/m-p/251853#M75292 <P>May just be a simple typo. You strptime format is missing a <CODE>%</CODE>. This works</P> <PRE><CODE>| makeresults | eval StartTime="2016-08-26 15:18:32.97" | eval EndTime="2016-08-26 15:18:38.4" | eval stime=strptime(StartTime,"%Y-%m-%d %H:%M:%S.%3N") | eval etime=strptime(EndTime,"%Y-%m-%d %H:%M:%S.%3N") | table StartTime EndTime stime etime </CODE></PRE> Fri, 26 Aug 2016 16:03:04 GMT sundareshr 2016-08-26T16:03:04Z https://community.splunk.com/t5/Splunk-Search/Unable-to-match-field-with-strptime/m-p/251852#M75291 <P>Hello all, I'm trying to calculate the amount of time a job took to run from an event that looks like so:</P> <PRE><CODE>2016-08-26 11:18:44 HistoryId="1710410", JobSource="861638A0-67C8-4661-B788-E615363436FA", JobId="6989A4FF-BD2B-43D6-8520-69A8A064600E", QueueTime="2016-08-26 15:18:32.147", StartTime="2016-08-26 15:18:32.97", EndTime="2016-08-26 15:18:38.4", AgentId="FD64361C-2F23-4496-9B69-3DDDD0D4DBA0", Result="0", ResultMessage="[Common Structures Warehouse Sync]: ---&gt; MakeDataChanges() result=NoChangesPending. ---&gt; Result: Succeeded", QueuedReasons="1", QueueFlags="0", Priority="7" </CODE></PRE> <P>Currently doing the following:</P> <PRE><CODE>index=application | lookup tfs_jobs jobID as JobId OUTPUT jobName | eval stime=strptime(StartTime,"Y-%m-%d %H:%M:%S.%3N") | eval etime=strptime(EndTime,"Y-%m-%d %H:%M:%S.%3N") | table stime </CODE></PRE> <P>Just to see if I can match the "StartTime" field.</P> <P>But appears that stime is not even populated because the table is blank. This event is coming from a MSSQL backend and I'm not 100% i'm matching the millisecond time at the end .97 correctly. I've also seen events come in as such:</P> <PRE><CODE>2016-08-26 10:48:44 HistoryId="1710403", JobSource="861638A0-67C8-4661-B788-E615363436FA", JobId="6989A4FF-BD2B-43D6-8520-69A8A064600E", QueueTime="2016-08-26 14:48:32.147", StartTime="2016-08-26 14:48:33.403", EndTime="2016-08-26 14:48:35.567", AgentId="FD64361C-2F23-4496-9B69-3DDDD0D4DBA0", Result="0", ResultMessage="[Common Structures Warehouse Sync]: ---&gt; MakeDataChanges() result=NoChangesPending. ---&gt; Result: Succeeded", QueuedReasons="1", QueueFlags="0", Priority="7" </CODE></PRE> <P>Which makes me conclude it's in milliseconds and I'm using the %3N. </P> <P>Any assistance on what I'm doing wrong would be appreciated.</P> <P>Thanks </P> Fri, 26 Aug 2016 15:53:19 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-match-field-with-strptime/m-p/251852#M75291 dondky 2016-08-26T15:53:19Z https://community.splunk.com/t5/Splunk-Search/Unable-to-match-field-with-strptime/m-p/251853#M75292 <P>May just be a simple typo. You strptime format is missing a <CODE>%</CODE>. This works</P> <PRE><CODE>| makeresults | eval StartTime="2016-08-26 15:18:32.97" | eval EndTime="2016-08-26 15:18:38.4" | eval stime=strptime(StartTime,"%Y-%m-%d %H:%M:%S.%3N") | eval etime=strptime(EndTime,"%Y-%m-%d %H:%M:%S.%3N") | table StartTime EndTime stime etime </CODE></PRE> Fri, 26 Aug 2016 16:03:04 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-match-field-with-strptime/m-p/251853#M75292 sundareshr 2016-08-26T16:03:04Z https://community.splunk.com/t5/Splunk-Search/Unable-to-match-field-with-strptime/m-p/251854#M75293 <P>Thank you! The %Y was the culprit. </P> Tue, 30 Aug 2016 17:51:16 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-match-field-with-strptime/m-p/251854#M75293 dondky 2016-08-30T17:51:16Z