Roman date parsing

vanvan — Tue, 10 Apr 2018 08:03:40 GMT

Hi,
I have a log with the following datetime format:
03 IV 2018 23:03:53.014

I am trying to parse it, but I am failing to succeed...
The format I am using during import of the file is the following:
%d %Om %Y %H:%M:%S

Thanks in advance!

Re: Roman date parsing

cmerriman — Tue, 10 Apr 2018 11:42:04 GMT

Splunk doesn't support Roman Numeral conversions. Perhaps suggest that as a feature request in the Splunk Support Portal. My suggestion is to replace the Roman Numerals with numbers and then create the date. something like this should work. Use the replace command and change the in date with your field name.

|makeresults|eval date="03 IV 2018 23:03:53.014"|replace "*I*" with *01* "*II*" with *02* "*III*" with *03* "*IV*" with *04* "*V*" with *05* "*VI*" with *06* "*VII*" with *07* "*VIII*" with *08* "*IX*" with *09* "*X*" with *10* "*XI*" with *11* "*XII*" with *12* in date|eval date2=strptime(date,"%d %m %Y %H:%M:%S")

topic Roman date parsing in Splunk Search

Roman date parsing

Re: Roman date parsing