Splunk Search

convert time field

gdavid
Path Finder

i have the last sync time for my activesync clients going to splunk via powershell input.
ex: LastSyncAttemptTime = 04/07/2016 21:49:08
this produces a text field that is not sortable or useable.
i tried to convert it using:

| eval lastSync=strptime(LastSyncAttemptTime,"%x %T") | table lastSync

with no luck. i have tired numerous variations of %codes to list the date and time, and a few variations produce a decimal value.

my end goal here is to look for clients that last synced over 30 days ago.

any ideas?

thanks

Gd

Tags (1)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi gdavid,

you can try this instead:

| eval lastSync=strptime(LastSyncAttemptTime, "%m/%d/%Y %H:%M:%S")

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi gdavid,

you can try this instead:

| eval lastSync=strptime(LastSyncAttemptTime, "%m/%d/%Y %H:%M:%S")

Hope this helps ...

cheers, MuS

gdavid
Path Finder

this seems to be working to generate the field in human readable format

lastSync=strftime(strptime(LastSyncAttemptTime, "%m/%d/%Y %H:%M:%S"),"%m/%d/%y %H:%M:%S")

what i realized is to finish the rest of the search it was easier to leave it in epoch time. use this for now:

| eval lastSync=strptime(LastSyncAttemptTime, "%m/%d/%Y %H:%M:%S") | eval lastsyncbad = relative_time(now(), "-30d" ) | where lastSync < lastsyncbad

there might be a more effective method but this works.

0 Karma

gdavid
Path Finder

that yields:

LastSyncAttemptTime
04/08/2016 07:19:46

lastSync
1460114386.000000

which looks like it converted it into epoch time. convert again?

0 Karma

MuS
SplunkTrust
SplunkTrust

What is your intention / use case? please explain a bit further otherwise no one will be able to help you in the end 😉

0 Karma

gdavid
Path Finder

from above: my end goal here is to look for clients that last synced over 30 days ago.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...