I have a CSV file uploaded via "lookup Editor" and my "Scan Date" column has the following time format:
11/19/2019 11:13:53 AM
I want Splunk to recognize this time format for me to tell it to display everything older than 7 days from now.
First step was to change it to epoch to then change to 11/19/2019 format, excluding the hour, minutes and seconds.
| eval "epoch"= strptime("Scan Date","%m/%d/%Y %I:%M:%S %p")
But I don't see anything when I:
table "epoch"
What am I missing?
For field names in that position/operation, you need to use '
or $
, like this:
| inputlookup YourCsvFileHere.csv
| eval _time= strptime('Scan Date', "%m/%d/%Y %I:%M:%S %p")
| addinfo
| replace "+Infinity" WITH "9999999999" IN info_max_time
| rename info_* AS _info_*
| where _time >= _info_min_time AND _time <= _info_max_time
But fields with spaces are EVIL so you could avoid all of that by doing:
| inputlookup YourCsvFileHere.csv
| rename "* *" AS *_*
| eval _time= strptime(Scan_Date, "%m/%d/%Y %I:%M:%S %p")
| addinfo
| replace "+Infinity" WITH "9999999999" IN info_max_time
| rename info_* AS _info_*
| where _time >= _info_min_time AND _time <= _info_max_time
For field names in that position/operation, you need to use '
or $
, like this:
| inputlookup YourCsvFileHere.csv
| eval _time= strptime('Scan Date', "%m/%d/%Y %I:%M:%S %p")
| addinfo
| replace "+Infinity" WITH "9999999999" IN info_max_time
| rename info_* AS _info_*
| where _time >= _info_min_time AND _time <= _info_max_time
But fields with spaces are EVIL so you could avoid all of that by doing:
| inputlookup YourCsvFileHere.csv
| rename "* *" AS *_*
| eval _time= strptime(Scan_Date, "%m/%d/%Y %I:%M:%S %p")
| addinfo
| replace "+Infinity" WITH "9999999999" IN info_max_time
| rename info_* AS _info_*
| where _time >= _info_min_time AND _time <= _info_max_time