Getting Data In

Help on strftime

jip31
Motivator

Hi

I have a field time called LastLogonDate with this format

6/28/2023 1:47.35 PM

I want to format this field in a new field 

So i am doing

| eval Last=strftime(LastLogonDate, "%d-%m-%y") but it doenst works 

What is wrong please?

 

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

I don't know why it doesn't run, so, please try this workaround:

| rex field=LastLogonDate "^(?<month>\d+)\/(?<day>\d+)\/(?<year>\d+)"
| eval day=if(day<10,"0".day,day), month=if(month<10,"0".month,month)
| eval Last=day."/".month."/".year

that I tested.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31 ,

you have to operate two conversions:

| eval Last=strftime(strptime(LastLogonDate, "%m/%d/%Y %I:%H.%S %p"),"%d-%m-%y") 

Only one beware: you used ":" betweeen hours and minutes and "." between minutes and seconds: is it an error or correct?

I followed your indication.

Ciao.

Giuseppe

0 Karma

jip31
Motivator

It's an error

I had : in your example between H and S

Your example wirks but only for some LadtLogonDate value but not for all

What is wrong please?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

if you can confirm that the format is "6/28/2023 1:47:35 PM", it should be correct.

As I said, check the format of the separators between hours, minutes and seconds: if one is wrong, all the formula is wrong.

| eval Last=strftime(strptime(LastLogonDate, "%m/%d/%Y %I:%H:%S %p"),"%d-%m-%y") 

Ciao.

Giuseppe

0 Karma

jip31
Motivator

It's strange because 7/3/2023 8:59:14 AM returns nothing while 1/18/2916 9:15:23 AM returns well 18-01-16 even if the forkat is the same...

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

the issue is in the day format, please try this:

| eval Last=strftime(strptime(LastLogonDate, "%m/%e/%Y %I:%H:%S %p"),"%d-%m-%y") 

Ciao.

Giuseppe

 

0 Karma

jip31
Motivator

sorry but exactly the same issue

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

please try this:

| eval Last=strftime(strptime(LastLogonDate, "%x %I:%H:%S %p"),"%d-%m-%y") 

Ciao.

Giuseppe

0 Karma

jip31
Motivator

hi

it changes nothing

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

I don't know why it doesn't run, so, please try this workaround:

| rex field=LastLogonDate "^(?<month>\d+)\/(?<day>\d+)\/(?<year>\d+)"
| eval day=if(day<10,"0".day,day), month=if(month<10,"0".month,month)
| eval Last=day."/".month."/".year

that I tested.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...