Splunk Search

How come strptime does not work for some days?

shaileshmali
Path Finder

There seems to be some issue with the strptime function. I'm not sure why it works for few days and does not work for few days.

works

index=_internal 
| eval Disconnect_Time="02/05/2019 08:22:40" 
| eval last_updated_date_epoch=strptime(Disconnect_Time,"%d/%m/%Y %H:%M:%S") 
| eval now=now() 
| eval diff=last_updated_date_epoch-now() 
| eval duration=diff/3600/24 
| table Disconnect_Time,last_updated_date_epoch,now,diff,duration

Does not work

index=_internal 
| eval Disconnect_Time="02/13/2019 08:22:40" 
| eval last_updated_date_epoch=strptime(Disconnect_Time,"%d/%m/%Y %H:%M:%S") 
| eval now=now() 
| eval diff=last_updated_date_epoch-now() 
| eval duration=diff/3600/24 
| table Disconnect_Time,last_updated_date_epoch,now,diff,duration
0 Karma

FrankVl
Ultra Champion

Because 13 is not a valid month number 😉

Think you need to swap the %d and %m in your time format 🙂

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...