Splunk Search

How To Concatenate String For Calculated Field?

vtsguerrero
Contributor

Hello everybody, sup?

I need a little help for this, I have fields separated for a datetime, for example:

day_ini = 22;
mon_ini = 03;
year_ini = 2014;
hour_ini = 14;
minute_ini = 19;
second_ini = 03.

I know we can eval them like this:

eval datetime=strftime(strptime((YEAR_INI+""+MONTH_INI+""+DAY_INI+"."+""+HOUR_INI+""+MINUTE_INI),"%Y%m%d.%H%M"),"%Y-%m-%d %T")     

In the search query it works perfectly, but when I put this for a calculated field, it doesn't concatenate, so the field is not created.
Is there another way I can create this calculated field using this strftime and strptime function together?

Thanks in advance!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

I tried something like this and worked fine for me (I was able to see the new field)

strftime(strptime((YEAR_INI.MONTH_INI.DAY_INI.".".HOUR_INI.MINUTE_INI),"%Y%m%d.%H%M"),"%Y-%m-%d %T")
0 Karma

vtsguerrero
Contributor

Hello, I'm not sure if calculated fields might accept two functions at once, because, I tried both ways and still can't see the new field in search even though I'm sure they fit the same sourcetype:

DATETIME_TEST01 strftime(strptime((ANO_INI_PV.MES_INI_PV.DIA_INI_PV.".".HORA_INI_PV.MINUTO_INI_PV),"%Y%m%d.%H%M"),"%Y-%m-%d %T")

DATETIME_TEST02 strftime(strptime(tostring(ANO_INI_PV)+tostring(MES_INI_PV)+tostring(DIA_INI_PV)+"."+tostring(HORA_INI_PV)+tostring(MINUTO_INI_PV),"%Y%m%d.%H%M"),"%Y-%m-%d %T")

Both still didn't work, I dunno what's happening...

0 Karma

masonmorales
Influencer

What happens if you do something like:

| eval datetime=strftime(strptime(tostring(YEAR_INI)+tostring(MONTH_INI)+tostring(DAY_INI)+"."+tostring(HOUR_INI)+tostring(MINUTE_INI),"%Y%m%d.%H%M"),"%Y-%m-%d %T")     
0 Karma

vtsguerrero
Contributor

Put the exact same way in Calculated Fields, still didn't create the new field... The strange thing is that, if I put the values hard code instead of variables ( MINUTE_INI, ETC ) it works, but if I need to concatenate these, they don't work...

0 Karma

vtsguerrero
Contributor

Just forgot to say, this will be a datetime generated from several string fields, this is why I need those functions, and this calculated field should join the strings and convert'em to a datetime...

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Can you try the . concatenator and see if it changes anything ?

0 Karma

vtsguerrero
Contributor

Still didn't work for the calculated field...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...