Difficult date time conversion

[timbitsandbytes]

Well it's a difficult conversion for me, anyway.

Here's the field: dateTime=Fri Jan 18 17:11:55 GMT+00:00 2013

• I want to convert it to seconds since the epoch so I can do a date comparison.
• I don't think there's a way for Splunk to recognize the tz offset as "+00:00" so first I transform that to "+0000".

eval dtFormatted=replace(dateTime, ":", "") |
eval dtSeconds=strptime(dtFormatted, "%a %b %d %H%M%S %Z%:z %Y")

In my search results "dtFormatted" is discovered and I've verified it's properly formatted but "dtSeconds" is not discovered.

What am I doing wrong? Why can't I convert this string to seconds?

[jonuwz · Accepted solution]

Try this :

... | rex mode=sed field=dateTime "s/(\+[0-9:]{5})/ \1/" 
    | eval dtSeconds=strptime(dateTime, "%a %b %d %T %Z %:z %Y")

The problem was that %Z expects a space after the time zone, In your format %Z was being set to GMT+0000 instead of GMT, and %Y was null.

[timbitsandbytes]

I see - I would not have caught that. But your sed/regex works great. Thanks very much!

[timbitsandbytes]

Yes, thanks. Unfortunately when I copied the search string (on a network that doesn't have access to the Internet) I miscopied it. It's been corrected above.

[jonuwz]

Shouldn't you have dtFormatted as the 1st argument to strptime ?