Splunk Search

How come strptime does not work for some days?

shaileshmali
Path Finder

There seems to be some issue with the strptime function. I'm not sure why it works for few days and does not work for few days.

works

index=_internal 
| eval Disconnect_Time="02/05/2019 08:22:40" 
| eval last_updated_date_epoch=strptime(Disconnect_Time,"%d/%m/%Y %H:%M:%S") 
| eval now=now() 
| eval diff=last_updated_date_epoch-now() 
| eval duration=diff/3600/24 
| table Disconnect_Time,last_updated_date_epoch,now,diff,duration

Does not work

index=_internal 
| eval Disconnect_Time="02/13/2019 08:22:40" 
| eval last_updated_date_epoch=strptime(Disconnect_Time,"%d/%m/%Y %H:%M:%S") 
| eval now=now() 
| eval diff=last_updated_date_epoch-now() 
| eval duration=diff/3600/24 
| table Disconnect_Time,last_updated_date_epoch,now,diff,duration
0 Karma

FrankVl
Ultra Champion

Because 13 is not a valid month number 😉

Think you need to swap the %d and %m in your time format 🙂

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...