Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Difficult date time conversion
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well it's a difficult conversion for me, anyway.
Here's the field: dateTime=Fri Jan 18 17:11:55 GMT+00:00 2013
- I want to convert it to seconds since the epoch so I can do a date comparison.
- I don't think there's a way for Splunk to recognize the tz offset as "+00:00" so first I transform that to "+0000".
eval dtFormatted=replace(dateTime, ":", "") |
eval dtSeconds=strptime(dtFormatted, "%a %b %d %H%M%S %Z%:z %Y")
In my search results "dtFormatted" is discovered and I've verified it's properly formatted but "dtSeconds" is not discovered.
What am I doing wrong? Why can't I convert this string to seconds?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this :
... | rex mode=sed field=dateTime "s/(\+[0-9:]{5})/ \1/"
| eval dtSeconds=strptime(dateTime, "%a %b %d %T %Z %:z %Y")
The problem was that %Z expects a space after the time zone, In your format %Z was being set to GMT+0000 instead of GMT, and %Y was null.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this :
... | rex mode=sed field=dateTime "s/(\+[0-9:]{5})/ \1/"
| eval dtSeconds=strptime(dateTime, "%a %b %d %T %Z %:z %Y")
The problem was that %Z expects a space after the time zone, In your format %Z was being set to GMT+0000 instead of GMT, and %Y was null.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I see - I would not have caught that. But your sed/regex works great. Thanks very much!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, thanks. Unfortunately when I copied the search string (on a network that doesn't have access to the Internet) I miscopied it. It's been corrected above.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Shouldn't you have dtFormatted as the 1st argument to strptime ?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner
The Data Connection - October 2026
Beyond the Acceleration Zone: Maximizing Your Success with Splunk Customer Experience ...
