extract date with characters between

[sbsbb]

I try to transform a date string, into a date, to enable splunk to sort it.

Here is a sample :
2013-01-17T09:35:49Z

Hi tried :
eval n=strftime(field, " %Y-%m-%dT%H:%M:%SZ")

But it doesn't work. Why ? What would be the best way to do this ?
Is there a way to automate the conversion at searchtime ?

[Damien_Dallimor · Accepted solution]

If I understand correctly you want to parse the string "2013-01-17T09:35:49Z" into a time value , so you should use str*ptime not strf*time

[sbsbb]

At index Time, splunk is able to reconize Timeformat automatically, is there a way to use the same recognition an search time, with "convert" for example ?

I have 4 different Timeformat for the same field, and I want to be able to convert it in one way...:
2014-08-15T10:13:00+02:00
2014-08-15T10:13:00.000+02:00
2014-08-15T08:41:36Z
2014-08-15T08:41:36.000Z

if I use
| convert auto()

I only get the year...
But somehow Splunk is able to handle this by indexing, maybe a function is missing being able to use it a search time ?

[sbsbb]

It was because of a leading space character... it works now, thanks

[Damien_Dallimor]

This worked fine for me, I think you have an accidental space character before the "%Y" :

...| eval foo="2013-01-17T09:35:49Z" | eval goo=strptime(foo,"%Y-%m-%dT%H:%M:%SZ") | table goo

[sbsbb]

Ok, thanks, but
eval n=strptime(field, " %Y-%m-%dT%H:%M:%SZ")
still returns no value