Getting Data In

Convert time in CSV upload

vulnfree
Explorer

I have a CSV file uploaded via "lookup Editor" and my "Scan Date" column has the following time format:

11/19/2019 11:13:53 AM

I want Splunk to recognize this time format for me to tell it to display everything older than 7 days from now.
First step was to change it to epoch to then change to 11/19/2019 format, excluding the hour, minutes and seconds.

| eval "epoch"= strptime("Scan Date","%m/%d/%Y %I:%M:%S %p")

But I don't see anything when I:

table "epoch" 

What am I missing?

Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

For field names in that position/operation, you need to use ' or $, like this:

| inputlookup YourCsvFileHere.csv
| eval _time= strptime('Scan Date', "%m/%d/%Y %I:%M:%S %p")
| addinfo
| replace "+Infinity" WITH "9999999999" IN info_max_time
| rename info_* AS _info_*
| where _time >= _info_min_time AND _time <= _info_max_time

But fields with spaces are EVIL so you could avoid all of that by doing:

| inputlookup YourCsvFileHere.csv
| rename "* *" AS *_*
| eval _time= strptime(Scan_Date, "%m/%d/%Y %I:%M:%S %p")
| addinfo
| replace "+Infinity" WITH "9999999999" IN info_max_time
| rename info_* AS _info_*
| where _time >= _info_min_time AND _time <= _info_max_time

View solution in original post

0 Karma

woodcock
Esteemed Legend

For field names in that position/operation, you need to use ' or $, like this:

| inputlookup YourCsvFileHere.csv
| eval _time= strptime('Scan Date', "%m/%d/%Y %I:%M:%S %p")
| addinfo
| replace "+Infinity" WITH "9999999999" IN info_max_time
| rename info_* AS _info_*
| where _time >= _info_min_time AND _time <= _info_max_time

But fields with spaces are EVIL so you could avoid all of that by doing:

| inputlookup YourCsvFileHere.csv
| rename "* *" AS *_*
| eval _time= strptime(Scan_Date, "%m/%d/%Y %I:%M:%S %p")
| addinfo
| replace "+Infinity" WITH "9999999999" IN info_max_time
| rename info_* AS _info_*
| where _time >= _info_min_time AND _time <= _info_max_time
0 Karma
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...