topic Re: Converting date to epoch time in Splunk Search

Converting date to epoch time

jvmerilla — Fri, 01 Dec 2017 09:20:48 GMT

I'm trying to convert a certain date to epoch time to calculate it with the current time. But for some reason it didn't work.

Here's my query:

index="sample_data" sourcetype="management_sampledata.csv" Status!=Closed
| eval reported_date = strptime("Reported Date", "%m/%d/%Y %H:%M")
| eval timenow = now()

The eval timenow = now() worked and it created a new field named "timenow". But the eval reported_date=strptime("Reported Date", "%m/%d/%Y %H:%M") didn't work. It does not create a new field named "reported_date" and so it did not convert the "Reported Date" to epoch time.

What could be the problem with this query.

Thanks in advance!

Re: Converting date to epoch time

harsmarvania57 — Fri, 01 Dec 2017 09:28:54 GMT

Hi @jvmerilla,

You are facing problem because there is whitespace in your Date field name you are giving it in " in strptime so please use below query

 index="sample_data" sourcetype="management_sampledata.csv" Status!=Closed
| rename "Reported Date" AS Reported_Date
| eval reported_date = strptime(Reported_Date, "%m/%d/%Y %H:%M")
| eval timenow = now()

I hope this helps.

Thanks,
Harshil

Re: Converting date to epoch time

jvmerilla — Fri, 01 Dec 2017 09:33:16 GMT

Hi @harsmarvania57,

It works!

Thank you so much! 🙂

Re: Converting date to epoch time

dsiob — Thu, 21 Dec 2017 08:00:00 GMT

You can use as it is:

index="sample_data" sourcetype="management_sampledata.csv" Status!=Closed | eval reported_date = strptime('Reported Date', "%m/%d/%Y %H:%M") | eval timenow = now()

Just need to use single quotes instead of double quotes.

Re: Converting date to epoch time

hortoristic — Wed, 30 Sep 2020 02:06:28 GMT

I can't seem to get the above snippet to change my Ephoch timestamp column to readable date - what am I doing wrong:

(index="wsecu_apps" OR index="wsecu_mobile_app") (username="" AND Useragent="" AND http_method=POST) OR (username="" AND http_user_agent="") | table username, http_user_agent, Useragent, eval timestamp = strptime(timestamp, "%m/%d/%Y %H:%M"),I'm still getting strangness.

Here is my query, the "timestamp" column is in the Epoch time and I just wanted to convert it to readable date:
(index="wsecu_apps" OR index="wsecu_mobile_app") (username="" AND Useragent="" AND http_method=POST) OR (username="" AND http_user_agent="") | table username, http_user_agent, Useragent, eval timestamp = strptime(timestamp, "%m/%d/%Y %H:%M")

The query won't even run.