How To Concatenate String For Calculated Field?

[vtsguerrero]

Hello everybody, sup?

I need a little help for this, I have fields separated for a datetime, for example:

day_ini = 22;
mon_ini = 03;
year_ini = 2014;
hour_ini = 14;
minute_ini = 19;
second_ini = 03.

I know we can eval them like this:

eval datetime=strftime(strptime((YEAR_INI+""+MONTH_INI+""+DAY_INI+"."+""+HOUR_INI+""+MINUTE_INI),"%Y%m%d.%H%M"),"%Y-%m-%d %T")     

In the search query it works perfectly, but when I put this for a calculated field, it doesn't concatenate, so the field is not created.
Is there another way I can create this calculated field using this strftime and strptime function together?

Thanks in advance!

[somesoni2]

I tried something like this and worked fine for me (I was able to see the new field)

strftime(strptime((YEAR_INI.MONTH_INI.DAY_INI.".".HOUR_INI.MINUTE_INI),"%Y%m%d.%H%M"),"%Y-%m-%d %T")

[vtsguerrero]

Hello, I'm not sure if calculated fields might accept two functions at once, because, I tried both ways and still can't see the new field in search even though I'm sure they fit the same sourcetype:

DATETIME_TEST01 strftime(strptime((ANO_INI_PV.MES_INI_PV.DIA_INI_PV.".".HORA_INI_PV.MINUTO_INI_PV),"%Y%m%d.%H%M"),"%Y-%m-%d %T")

DATETIME_TEST02 strftime(strptime(tostring(ANO_INI_PV)+tostring(MES_INI_PV)+tostring(DIA_INI_PV)+"."+tostring(HORA_INI_PV)+tostring(MINUTO_INI_PV),"%Y%m%d.%H%M"),"%Y-%m-%d %T")

Both still didn't work, I dunno what's happening...

[masonmorales]

What happens if you do something like:

| eval datetime=strftime(strptime(tostring(YEAR_INI)+tostring(MONTH_INI)+tostring(DAY_INI)+"."+tostring(HOUR_INI)+tostring(MINUTE_INI),"%Y%m%d.%H%M"),"%Y-%m-%d %T")     

[vtsguerrero]

Put the exact same way in Calculated Fields, still didn't create the new field... The strange thing is that, if I put the values hard code instead of variables ( MINUTE_INI, ETC ) it works, but if I need to concatenate these, they don't work...

[vtsguerrero]

Just forgot to say, this will be a datetime generated from several string fields, this is why I need those functions, and this calculated field should join the strings and convert'em to a datetime...

[aljohnson_splun]

Can you try the . concatenator and see if it changes anything ?

[vtsguerrero]

Still didn't work for the calculated field...