https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260467#M78105 <P>Did you try Auto Extraction?</P> Wed, 23 Mar 2016 17:24:49 GMT sk314 2016-03-23T17:24:49Z https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260466#M78104 <P>I've been trying to import the data into splunk and have been unable to get the time/date to work. Included is a screenshot. Any help is appreciated<IMG src="http://i.imgur.com/L6fCwRx.png" alt="alt text" /></P> Wed, 23 Mar 2016 16:50:07 GMT https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260466#M78104 svercelli 2016-03-23T16:50:07Z https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260467#M78105 <P>Did you try Auto Extraction?</P> Wed, 23 Mar 2016 17:24:49 GMT https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260467#M78105 sk314 2016-03-23T17:24:49Z https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260468#M78106 <P>The screen shot is not visible. Try pasting some sample data as well as the strptime() strings you've tried.</P> Wed, 23 Mar 2016 17:34:17 GMT https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260468#M78106 richgalloway 2016-03-23T17:34:17Z https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260469#M78107 <P>Could you provide the other configuration that you're using here, is this a structured format file (PSV/CSV/TSV etc)? </P> Wed, 23 Mar 2016 18:14:33 GMT https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260469#M78107 somesoni2 2016-03-23T18:14:33Z https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260470#M78108 <P>its a csv.</P> Thu, 24 Mar 2016 16:50:23 GMT https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260470#M78108 svercelli 2016-03-24T16:50:23Z https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260471#M78109 <P>yes. no luck.</P> Thu, 24 Mar 2016 16:50:31 GMT https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260471#M78109 svercelli 2016-03-24T16:50:31Z https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260472#M78110 <P><IMG src="http://i.imgur.com/86kSyCd.jpg" alt="Here it is" /></P> Thu, 24 Mar 2016 16:53:20 GMT https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260472#M78110 svercelli 2016-03-24T16:53:20Z https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260473#M78111 <P>The time I'm trying to base it on is the Start Date.</P> Thu, 24 Mar 2016 16:54:00 GMT https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260473#M78111 svercelli 2016-03-24T16:54:00Z https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260474#M78112 <P>I don't see a Start Date. There is no screen shot or sample data.</P> Thu, 24 Mar 2016 19:37:03 GMT https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260474#M78112 richgalloway 2016-03-24T19:37:03Z https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260475#M78113 <P>Can you type out your Timestamp format. It's VERY hard to read. </P> <P>My guess is that there line break in that field you're trying to extract from. </P> <P>I also don't see an AM or PM so you shouldn't be using %p at all.</P> <P>Should be: %m/%d/%Y %k:%M</P> Thu, 24 Mar 2016 19:42:29 GMT https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260475#M78113 michael_kushma 2016-03-24T19:42:29Z https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260476#M78114 <P>Well, I did some testing with sample CSV data and looks like the time format is the issue. The TIME format should be exactly same as what's in the "Start Date" field. So try timestamp format as "<CODE>%m/%d/%Y %H:%M</CODE>"</P> Thu, 24 Mar 2016 21:27:48 GMT https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260476#M78114 somesoni2 2016-03-24T21:27:48Z https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260477#M78115 <P>It should be this:</P> <PRE><CODE>%m/%d/%Y %H:%M </CODE></PRE> Tue, 29 Mar 2016 15:26:47 GMT https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260477#M78115 woodcock 2016-03-29T15:26:47Z https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260478#M78116 <P>Found that %m/%e/%y %k:%M worked.</P> Tue, 29 Mar 2016 21:53:06 GMT https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260478#M78116 svercelli 2016-03-29T21:53:06Z https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260479#M78117 <P>%Y is a 4-digit year</P> <P>%y is the 2-digit year</P> Tue, 29 Mar 2016 22:14:10 GMT https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260479#M78117 lguinn2 2016-03-29T22:14:10Z https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260480#M78118 <P>Missed it by that much!</P> Wed, 30 Mar 2016 02:59:52 GMT https://community.splunk.com/t5/Splunk-Search/Strptime-statement-not-extracting-date-time/m-p/260480#M78118 woodcock 2016-03-30T02:59:52Z