Splunk Search

How To Concatenate String For Calculated Field?

Contributor

Hello everybody, sup?

I need a little help for this, I have fields separated for a datetime, for example:

day_ini = 22;
mon_ini = 03;
year_ini = 2014;
hour_ini = 14;
minute_ini = 19;
second_ini = 03.

I know we can eval them like this:

eval datetime=strftime(strptime((YEAR_INI+""+MONTH_INI+""+DAY_INI+"."+""+HOUR_INI+""+MINUTE_INI),"%Y%m%d.%H%M"),"%Y-%m-%d %T")     

In the search query it works perfectly, but when I put this for a calculated field, it doesn't concatenate, so the field is not created.
Is there another way I can create this calculated field using this strftime and strptime function together?

Thanks in advance!

0 Karma

Revered Legend

I tried something like this and worked fine for me (I was able to see the new field)

strftime(strptime((YEAR_INI.MONTH_INI.DAY_INI.".".HOUR_INI.MINUTE_INI),"%Y%m%d.%H%M"),"%Y-%m-%d %T")
0 Karma

Contributor

Hello, I'm not sure if calculated fields might accept two functions at once, because, I tried both ways and still can't see the new field in search even though I'm sure they fit the same sourcetype:

DATETIME_TEST01 strftime(strptime((ANO_INI_PV.MES_INI_PV.DIA_INI_PV.".".HORA_INI_PV.MINUTO_INI_PV),"%Y%m%d.%H%M"),"%Y-%m-%d %T")

DATETIME_TEST02 strftime(strptime(tostring(ANO_INI_PV)+tostring(MES_INI_PV)+tostring(DIA_INI_PV)+"."+tostring(HORA_INI_PV)+tostring(MINUTO_INI_PV),"%Y%m%d.%H%M"),"%Y-%m-%d %T")

Both still didn't work, I dunno what's happening...

0 Karma

Influencer

What happens if you do something like:

| eval datetime=strftime(strptime(tostring(YEAR_INI)+tostring(MONTH_INI)+tostring(DAY_INI)+"."+tostring(HOUR_INI)+tostring(MINUTE_INI),"%Y%m%d.%H%M"),"%Y-%m-%d %T")     
0 Karma

Contributor

Put the exact same way in Calculated Fields, still didn't create the new field... The strange thing is that, if I put the values hard code instead of variables ( MINUTE_INI, ETC ) it works, but if I need to concatenate these, they don't work...

0 Karma

Contributor

Just forgot to say, this will be a datetime generated from several string fields, this is why I need those functions, and this calculated field should join the strings and convert'em to a datetime...

0 Karma

Splunk Employee
Splunk Employee

Can you try the . concatenator and see if it changes anything ?

0 Karma

Contributor

Still didn't work for the calculated field...

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!