Help on strftime

[jip31]

Hi

I have a field time called LastLogonDate with this format

6/28/2023 1:47.35 PM

I want to format this field in a new field 

So i am doing

| eval Last=strftime(LastLogonDate, "%d-%m-%y") but it doenst works 

What is wrong please?

[gcusello]

Hi @jip31 ,

you have to operate two conversions:

| eval Last=strftime(strptime(LastLogonDate, "%m/%d/%Y %I:%H.%S %p"),"%d-%m-%y") 

Only one beware: you used ":" betweeen hours and minutes and "." between minutes and seconds: is it an error or correct?

I followed your indication.

Ciao.

Giuseppe

[jip31]

It's an error

I had : in your example between H and S

Your example wirks but only for some LadtLogonDate value but not for all

What is wrong please?

[gcusello]

Hi @jip31,

if you can confirm that the format is "6/28/2023 1:47:35 PM", it should be correct.

As I said, check the format of the separators between hours, minutes and seconds: if one is wrong, all the formula is wrong.

| eval Last=strftime(strptime(LastLogonDate, "%m/%d/%Y %I:%H:%S %p"),"%d-%m-%y") 

Ciao.

Giuseppe

[jip31]

It's strange because 7/3/2023 8:59:14 AM returns nothing while 1/18/2916 9:15:23 AM returns well 18-01-16 even if the forkat is the same...

[gcusello]

Hi @jip31,

the issue is in the day format, please try this:

| eval Last=strftime(strptime(LastLogonDate, "%m/%e/%Y %I:%H:%S %p"),"%d-%m-%y") 

Ciao.

Giuseppe

[jip31]

sorry but exactly the same issue

[gcusello]

Hi @jip31,

please try this:

| eval Last=strftime(strptime(LastLogonDate, "%x %I:%H:%S %p"),"%d-%m-%y") 

Ciao.

Giuseppe

[jip31]

hi

it changes nothing

[gcusello · Accepted solution]

Hi @jip31,

I don't know why it doesn't run, so, please try this workaround:

| rex field=LastLogonDate "^(?<month>\d+)\/(?<day>\d+)\/(?<year>\d+)"
| eval day=if(day<10,"0".day,day), month=if(month<10,"0".month,month)
| eval Last=day."/".month."/".year

that I tested.

Ciao.

Giuseppe

[gcusello]

Hi @jip31,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉