Splunk Search

Converting date to epoch time

Path Finder

Hi

I'm trying to convert a certain date to epoch time to calculate it with the current time. But for some reason it didn't work.

Here's my query:

index="sample_data" sourcetype="management_sampledata.csv" Status!=Closed
| eval reported_date = strptime("Reported Date", "%m/%d/%Y %H:%M")
| eval timenow = now()

The eval timenow = now() worked and it created a new field named "timenow". But the eval reported_date=strptime("Reported Date", "%m/%d/%Y %H:%M") didn't work. It does not create a new field named "reported_date" and so it did not convert the "Reported Date" to epoch time.

What could be the problem with this query.

Thanks in advance!

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi @jvmerilla,

You are facing problem because there is whitespace in your Date field name you are giving it in " in strptime so please use below query

 index="sample_data" sourcetype="management_sampledata.csv" Status!=Closed
| rename "Reported Date" AS Reported_Date
| eval reported_date = strptime(Reported_Date, "%m/%d/%Y %H:%M")
| eval timenow = now()

I hope this helps.

Thanks,
Harshil

View solution in original post

New Member

I can't seem to get the above snippet to change my Ephoch timestamp column to readable date - what am I doing wrong:

(index="wsecu_apps" OR index="wsecu_mobile_app") (username="" AND Useragent="" AND http_method=POST) OR (username="" AND http_user_agent="") | table username, http_user_agent, Useragent, eval timestamp = strptime(timestamp, "%m/%d/%Y %H:%M"),I'm still getting strangness.

Here is my query, the "timestamp" column is in the Epoch time and I just wanted to convert it to readable date:
(index="wsecu_apps" OR index="wsecu_mobile_app") (username="" AND Useragent="" AND http_method=POST) OR (username="" AND http_user_agent="") | table username, http_user_agent, Useragent, eval timestamp = strptime(timestamp, "%m/%d/%Y %H:%M")

The query won't even run.

0 Karma

Communicator

You can use as it is:

index="sample_data" sourcetype="management_sampledata.csv" Status!=Closed
| eval reported_date = strptime('Reported Date', "%m/%d/%Y %H:%M")
| eval timenow = now()

Just need to use single quotes instead of double quotes.

0 Karma

SplunkTrust
SplunkTrust

Hi @jvmerilla,

You are facing problem because there is whitespace in your Date field name you are giving it in " in strptime so please use below query

 index="sample_data" sourcetype="management_sampledata.csv" Status!=Closed
| rename "Reported Date" AS Reported_Date
| eval reported_date = strptime(Reported_Date, "%m/%d/%Y %H:%M")
| eval timenow = now()

I hope this helps.

Thanks,
Harshil

View solution in original post

Path Finder

Hi @harsmarvania57,

It works!

Thank you so much! 🙂

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!