Getting Data In

Help on strftime

jip31
Motivator

Hi

I have a field time called LastLogonDate with this format

6/28/2023 1:47.35 PM

I want to format this field in a new field 

So i am doing

| eval Last=strftime(LastLogonDate, "%d-%m-%y") but it doenst works 

What is wrong please?

 

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

I don't know why it doesn't run, so, please try this workaround:

| rex field=LastLogonDate "^(?<month>\d+)\/(?<day>\d+)\/(?<year>\d+)"
| eval day=if(day<10,"0".day,day), month=if(month<10,"0".month,month)
| eval Last=day."/".month."/".year

that I tested.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31 ,

you have to operate two conversions:

| eval Last=strftime(strptime(LastLogonDate, "%m/%d/%Y %I:%H.%S %p"),"%d-%m-%y") 

Only one beware: you used ":" betweeen hours and minutes and "." between minutes and seconds: is it an error or correct?

I followed your indication.

Ciao.

Giuseppe

0 Karma

jip31
Motivator

It's an error

I had : in your example between H and S

Your example wirks but only for some LadtLogonDate value but not for all

What is wrong please?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

if you can confirm that the format is "6/28/2023 1:47:35 PM", it should be correct.

As I said, check the format of the separators between hours, minutes and seconds: if one is wrong, all the formula is wrong.

| eval Last=strftime(strptime(LastLogonDate, "%m/%d/%Y %I:%H:%S %p"),"%d-%m-%y") 

Ciao.

Giuseppe

0 Karma

jip31
Motivator

It's strange because 7/3/2023 8:59:14 AM returns nothing while 1/18/2916 9:15:23 AM returns well 18-01-16 even if the forkat is the same...

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

the issue is in the day format, please try this:

| eval Last=strftime(strptime(LastLogonDate, "%m/%e/%Y %I:%H:%S %p"),"%d-%m-%y") 

Ciao.

Giuseppe

 

0 Karma

jip31
Motivator

sorry but exactly the same issue

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

please try this:

| eval Last=strftime(strptime(LastLogonDate, "%x %I:%H:%S %p"),"%d-%m-%y") 

Ciao.

Giuseppe

0 Karma

jip31
Motivator

hi

it changes nothing

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

I don't know why it doesn't run, so, please try this workaround:

| rex field=LastLogonDate "^(?<month>\d+)\/(?<day>\d+)\/(?<year>\d+)"
| eval day=if(day<10,"0".day,day), month=if(month<10,"0".month,month)
| eval Last=day."/".month."/".year

that I tested.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...