Getting Data In

Convert time in CSV upload

vulnfree
Explorer

I have a CSV file uploaded via "lookup Editor" and my "Scan Date" column has the following time format:

11/19/2019 11:13:53 AM

I want Splunk to recognize this time format for me to tell it to display everything older than 7 days from now.
First step was to change it to epoch to then change to 11/19/2019 format, excluding the hour, minutes and seconds.

| eval "epoch"= strptime("Scan Date","%m/%d/%Y %I:%M:%S %p")

But I don't see anything when I:

table "epoch" 

What am I missing?

Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

For field names in that position/operation, you need to use ' or $, like this:

| inputlookup YourCsvFileHere.csv
| eval _time= strptime('Scan Date', "%m/%d/%Y %I:%M:%S %p")
| addinfo
| replace "+Infinity" WITH "9999999999" IN info_max_time
| rename info_* AS _info_*
| where _time >= _info_min_time AND _time <= _info_max_time

But fields with spaces are EVIL so you could avoid all of that by doing:

| inputlookup YourCsvFileHere.csv
| rename "* *" AS *_*
| eval _time= strptime(Scan_Date, "%m/%d/%Y %I:%M:%S %p")
| addinfo
| replace "+Infinity" WITH "9999999999" IN info_max_time
| rename info_* AS _info_*
| where _time >= _info_min_time AND _time <= _info_max_time

View solution in original post

0 Karma

woodcock
Esteemed Legend

For field names in that position/operation, you need to use ' or $, like this:

| inputlookup YourCsvFileHere.csv
| eval _time= strptime('Scan Date', "%m/%d/%Y %I:%M:%S %p")
| addinfo
| replace "+Infinity" WITH "9999999999" IN info_max_time
| rename info_* AS _info_*
| where _time >= _info_min_time AND _time <= _info_max_time

But fields with spaces are EVIL so you could avoid all of that by doing:

| inputlookup YourCsvFileHere.csv
| rename "* *" AS *_*
| eval _time= strptime(Scan_Date, "%m/%d/%Y %I:%M:%S %p")
| addinfo
| replace "+Infinity" WITH "9999999999" IN info_max_time
| rename info_* AS _info_*
| where _time >= _info_min_time AND _time <= _info_max_time
0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...