Getting Data In

Convert time in CSV upload

vulnfree
Explorer

I have a CSV file uploaded via "lookup Editor" and my "Scan Date" column has the following time format:

11/19/2019 11:13:53 AM

I want Splunk to recognize this time format for me to tell it to display everything older than 7 days from now.
First step was to change it to epoch to then change to 11/19/2019 format, excluding the hour, minutes and seconds.

| eval "epoch"= strptime("Scan Date","%m/%d/%Y %I:%M:%S %p")

But I don't see anything when I:

table "epoch" 

What am I missing?

Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

For field names in that position/operation, you need to use ' or $, like this:

| inputlookup YourCsvFileHere.csv
| eval _time= strptime('Scan Date', "%m/%d/%Y %I:%M:%S %p")
| addinfo
| replace "+Infinity" WITH "9999999999" IN info_max_time
| rename info_* AS _info_*
| where _time >= _info_min_time AND _time <= _info_max_time

But fields with spaces are EVIL so you could avoid all of that by doing:

| inputlookup YourCsvFileHere.csv
| rename "* *" AS *_*
| eval _time= strptime(Scan_Date, "%m/%d/%Y %I:%M:%S %p")
| addinfo
| replace "+Infinity" WITH "9999999999" IN info_max_time
| rename info_* AS _info_*
| where _time >= _info_min_time AND _time <= _info_max_time

View solution in original post

0 Karma

woodcock
Esteemed Legend

For field names in that position/operation, you need to use ' or $, like this:

| inputlookup YourCsvFileHere.csv
| eval _time= strptime('Scan Date', "%m/%d/%Y %I:%M:%S %p")
| addinfo
| replace "+Infinity" WITH "9999999999" IN info_max_time
| rename info_* AS _info_*
| where _time >= _info_min_time AND _time <= _info_max_time

But fields with spaces are EVIL so you could avoid all of that by doing:

| inputlookup YourCsvFileHere.csv
| rename "* *" AS *_*
| eval _time= strptime(Scan_Date, "%m/%d/%Y %I:%M:%S %p")
| addinfo
| replace "+Infinity" WITH "9999999999" IN info_max_time
| rename info_* AS _info_*
| where _time >= _info_min_time AND _time <= _info_max_time
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...