Splunk Search

Can splunk convert a date to epoch time if the year is 1970

Explorer

When running the search:

| eval startTime="1970-01-01"| eval dateadded_epoch = strptime(startTime, "%Y-%m-%d")| table Jobname dateadded_epoch

alt text

I get no results, but if the year is changed to 1971 I get the expected output.

alt text

1 Solution

SplunkTrust
SplunkTrust

I think you may have found a bug. I can reproduce proper results with any date in 1971 or newer, but none in 1970.

Jan 01, 1971 is 31557600 as you noticed, so you'd think that Dec 31st 1970 would be 31557600-86400, an answer which escapes my ability to run a calculator app right now, but which is decidedly greater than 0.

View solution in original post

SplunkTrust
SplunkTrust

I think you may have found a bug. I can reproduce proper results with any date in 1971 or newer, but none in 1970.

Jan 01, 1971 is 31557600 as you noticed, so you'd think that Dec 31st 1970 would be 31557600-86400, an answer which escapes my ability to run a calculator app right now, but which is decidedly greater than 0.

View solution in original post

SplunkTrust
SplunkTrust

Even better:

index=* | eval startTime=31557600 
| eval a_dateadded_realdate = strftime(startTime, "%Y-%m-%d %H:%M:%S") 
| eval a_dateadded_epoch = strptime(a_dateadded_realdate, "%Y-%m-%d %H:%M:%S") 
| table startTime a_dateadded_epoch a_dateadded_realdate

If you run that, you'll get valid dates in both columns.

If you subtract one and use 31557599, the strftime works but the strptime won't convert it back.

0 Karma

Splunk Employee
Splunk Employee

This is known, and not something that will be fixed.

Brian

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!