https://community.splunk.com/t5/Splunk-Search/strptime-for-a-existing-time-field-in-lookup-table-and-adding/m-p/309860#M92960 <P>give the name as the inputlookup file u can still able to edit it</P> <P>| inputlookup yourtablename.csv<BR /> | eval my_time = strptime (date_last, "%Y-%m-%FT%H:%M%S.000Z")<BR /> | eval _time = my_time<BR /> | outputlookup yourtablename.csv</P> Tue, 29 Sep 2020 18:45:31 GMT splunker12er 2020-09-29T18:45:31Z https://community.splunk.com/t5/Splunk-Search/strptime-for-a-existing-time-field-in-lookup-table-and-adding/m-p/309854#M92954 <P>i have a timefield "date_last" in a lookup table: 2018-03-20T12:25:00.000Z </P> <P>which i have tried to extract the field using the following(correct me if i'm wrong):</P> <PRE><CODE>| myinputlookup | eval my_time = strptime (date_last, "%Y-%m-%FT%H:%M%S.000Z") | eval _time = my_time </CODE></PRE> <P>how would I update the lookup table to contain a new field labeled as "_time"</P> Mon, 02 Apr 2018 05:53:34 GMT https://community.splunk.com/t5/Splunk-Search/strptime-for-a-existing-time-field-in-lookup-table-and-adding/m-p/309854#M92954 esmonder 2018-04-02T05:53:34Z https://community.splunk.com/t5/Splunk-Search/strptime-for-a-existing-time-field-in-lookup-table-and-adding/m-p/309855#M92955 <P>are you trying to read and write to the same lookup file ?</P> Mon, 02 Apr 2018 07:08:49 GMT https://community.splunk.com/t5/Splunk-Search/strptime-for-a-existing-time-field-in-lookup-table-and-adding/m-p/309855#M92955 splunker12er 2018-04-02T07:08:49Z https://community.splunk.com/t5/Splunk-Search/strptime-for-a-existing-time-field-in-lookup-table-and-adding/m-p/309856#M92956 <PRE><CODE> | myinputlookup | eval my_time = strptime (date_last, "%Y-%m-%FT%H:%M%S.000Z") | eval _time = my_time | outputlookup outlookup.csv </CODE></PRE> Mon, 02 Apr 2018 07:23:18 GMT https://community.splunk.com/t5/Splunk-Search/strptime-for-a-existing-time-field-in-lookup-table-and-adding/m-p/309856#M92956 splunker12er 2018-04-02T07:23:18Z https://community.splunk.com/t5/Splunk-Search/strptime-for-a-existing-time-field-in-lookup-table-and-adding/m-p/309857#M92957 <P>yes i am <BR /> /10char</P> Mon, 02 Apr 2018 07:30:24 GMT https://community.splunk.com/t5/Splunk-Search/strptime-for-a-existing-time-field-in-lookup-table-and-adding/m-p/309857#M92957 esmonder 2018-04-02T07:30:24Z https://community.splunk.com/t5/Splunk-Search/strptime-for-a-existing-time-field-in-lookup-table-and-adding/m-p/309858#M92958 <P>any way to update the existing lookup file?</P> Mon, 02 Apr 2018 07:31:14 GMT https://community.splunk.com/t5/Splunk-Search/strptime-for-a-existing-time-field-in-lookup-table-and-adding/m-p/309858#M92958 esmonder 2018-04-02T07:31:14Z https://community.splunk.com/t5/Splunk-Search/strptime-for-a-existing-time-field-in-lookup-table-and-adding/m-p/309859#M92959 <P>This may be help you:</P> <P><A href="https://answers.splunk.com/answers/387428/how-to-update-a-lookup-table.html">https://answers.splunk.com/answers/387428/how-to-update-a-lookup-table.html</A></P> Mon, 02 Apr 2018 07:36:35 GMT https://community.splunk.com/t5/Splunk-Search/strptime-for-a-existing-time-field-in-lookup-table-and-adding/m-p/309859#M92959 p_gurav 2018-04-02T07:36:35Z https://community.splunk.com/t5/Splunk-Search/strptime-for-a-existing-time-field-in-lookup-table-and-adding/m-p/309860#M92960 <P>give the name as the inputlookup file u can still able to edit it</P> <P>| inputlookup yourtablename.csv<BR /> | eval my_time = strptime (date_last, "%Y-%m-%FT%H:%M%S.000Z")<BR /> | eval _time = my_time<BR /> | outputlookup yourtablename.csv</P> Tue, 29 Sep 2020 18:45:31 GMT https://community.splunk.com/t5/Splunk-Search/strptime-for-a-existing-time-field-in-lookup-table-and-adding/m-p/309860#M92960 splunker12er 2020-09-29T18:45:31Z https://community.splunk.com/t5/Splunk-Search/strptime-for-a-existing-time-field-in-lookup-table-and-adding/m-p/309861#M92961 <P>Thanks it works! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 02 Apr 2018 10:10:30 GMT https://community.splunk.com/t5/Splunk-Search/strptime-for-a-existing-time-field-in-lookup-table-and-adding/m-p/309861#M92961 esmonder 2018-04-02T10:10:30Z https://community.splunk.com/t5/Splunk-Search/strptime-for-a-existing-time-field-in-lookup-table-and-adding/m-p/309862#M92962 <P>hmm it seems to work on the search app (i see _time in the table), but when i went to review the csv file with the lookup editor app, the table just doubled in size (2x rows, no new columns). <BR /> cant seem to update the original csv file. </P> <P>did more research and came out with this SPL but still didnt seem to work:<BR /> | inputlookup append=true test.csv <BR /> | appendcols <BR /> [| inputlookup append=true test.csv <BR /> | eval n = strftime((strptime(date_last, "%Y-%m-%dT%H:%M:%S.000Z")), "%m/%d/%Y %H:%M:%S") <BR /> | eval _time = n] <BR /> | outputlookup append=true test.csv</P> Tue, 03 Apr 2018 01:30:58 GMT https://community.splunk.com/t5/Splunk-Search/strptime-for-a-existing-time-field-in-lookup-table-and-adding/m-p/309862#M92962 esmonder 2018-04-03T01:30:58Z