Splunk Search

Help with a STRPTIME

cramasta
Builder

So when Splunk admon changed from 4.1.5 to 4.1.6 they also changed how it exacted a timestamp field from AD

4.1.5 had fields that looked like this

whenChanged=20100128233113.0Z

whenCreated=20100128232712.0Z

With this format I could create a nice STRPTIME that worked for turning this into timestamp splunk understood


4.1.6 came out and changed it to this

whenCreated=10:15.04 pm, Tue 02/12/2008

whenChanged=10:23.00 pm, Tue 02/12/2008

In 4.3 ADMON the timestamp is still extracted in the 4.1.6 format

Does anyone have any suggestions on how I can create a STRPTIME to recognize this format. I cant seem to figure out a way to get it to understand/ignore the abbreviated days of the week.

Thanks,
J

Tags (2)
0 Karma
1 Solution

lguinn2
Legend
strptime(whenCreated, "%I:%M.%S %p, %a %m/%d/%Y")

should work...

View solution in original post

lguinn2
Legend
strptime(whenCreated, "%I:%M.%S %p, %a %m/%d/%Y")

should work...

cramasta
Builder

that worked great thank you very much. I read right over the %a function when looking up strptime formats.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...