Splunk Search

How do you use strptime with different date formats?

JoshuaJohn
Contributor

I have two date formats coming into my index (01/11/2018) and (01/11/18). I wrote:

| eval LastSeen_epoch = strptime('LastSeen', "%m/%d/%Y %H:%M"),strptime('LastSeen', "%m/%d/%y %H:%M")

However, this does not work to convert both types that are coming in. (Y and y) are the differences.

Any ideas?

t_hartmann
Engager

Try wrapping your strptime calls in coalsece like this:

eval LastSeen_epoch = coalesce(strptime('LastSeen', "%m/%d/%Y %H:%M"),strptime('LastSeen', "%m/%d/%y %H:%M"))

This should return the epoch time for the first format which can be successfully used to parse LastSeen.

0 Karma

Vijeta
Influencer

Check the length of your "Last_date" field using len() function, if length is 8 then use %y format else if length is 10 use %Y format. Let me know if you need help forming the query.

Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...