Getting Data In

Help on strftime

jip31
Motivator

Hi

I have a field time called LastLogonDate with this format

6/28/2023 1:47.35 PM

I want to format this field in a new field 

So i am doing

| eval Last=strftime(LastLogonDate, "%d-%m-%y") but it doenst works 

What is wrong please?

 

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

I don't know why it doesn't run, so, please try this workaround:

| rex field=LastLogonDate "^(?<month>\d+)\/(?<day>\d+)\/(?<year>\d+)"
| eval day=if(day<10,"0".day,day), month=if(month<10,"0".month,month)
| eval Last=day."/".month."/".year

that I tested.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31 ,

you have to operate two conversions:

| eval Last=strftime(strptime(LastLogonDate, "%m/%d/%Y %I:%H.%S %p"),"%d-%m-%y") 

Only one beware: you used ":" betweeen hours and minutes and "." between minutes and seconds: is it an error or correct?

I followed your indication.

Ciao.

Giuseppe

0 Karma

jip31
Motivator

It's an error

I had : in your example between H and S

Your example wirks but only for some LadtLogonDate value but not for all

What is wrong please?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

if you can confirm that the format is "6/28/2023 1:47:35 PM", it should be correct.

As I said, check the format of the separators between hours, minutes and seconds: if one is wrong, all the formula is wrong.

| eval Last=strftime(strptime(LastLogonDate, "%m/%d/%Y %I:%H:%S %p"),"%d-%m-%y") 

Ciao.

Giuseppe

0 Karma

jip31
Motivator

It's strange because 7/3/2023 8:59:14 AM returns nothing while 1/18/2916 9:15:23 AM returns well 18-01-16 even if the forkat is the same...

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

the issue is in the day format, please try this:

| eval Last=strftime(strptime(LastLogonDate, "%m/%e/%Y %I:%H:%S %p"),"%d-%m-%y") 

Ciao.

Giuseppe

 

0 Karma

jip31
Motivator

sorry but exactly the same issue

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

please try this:

| eval Last=strftime(strptime(LastLogonDate, "%x %I:%H:%S %p"),"%d-%m-%y") 

Ciao.

Giuseppe

0 Karma

jip31
Motivator

hi

it changes nothing

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

I don't know why it doesn't run, so, please try this workaround:

| rex field=LastLogonDate "^(?<month>\d+)\/(?<day>\d+)\/(?<year>\d+)"
| eval day=if(day<10,"0".day,day), month=if(month<10,"0".month,month)
| eval Last=day."/".month."/".year

that I tested.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...