Getting Data In

Why is AM/PM not properly extracted by %p for for 12 hour timestamps?

Path Finder
index=myindex | eval originaltime=strptime(eventTime, "%b %d, %Y %H:%M:%S %p")

Some sample values of eventTime parameter are

Dec 04, 2014 12:31:57 PM
Dec 04, 2014 12:31:58 PM
Dec 04, 2014 12:31:50 PM

Why is %p not recognizing PM? The value of originaltime is always AM. E.g: if the eventTIme is 1:30 PM today, then the originaltime gets the epoch time for 1:30 AM today. Somehow %p is not recognizing %p. Any suggestions??

Splunk verion: 6.1.3

0 Karma


I was having the same issue with the following timestamp on a custom sourcetype: 12:04:36.260353 AM. Using Timestamp format %H:%M:%S.%6N %P was indexing the data as PM for AM. Changed to %I:%M:%S.%6N %P and it now works.

New Member

I think you must replace the %H by %I

index=myindex | eval originaltime=strptime(eventTime, "%b %d, %Y %I:%M:%S %p")
0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...