Splunk Search

How do you use strptime with different date formats?

JoshuaJohn
Contributor

I have two date formats coming into my index (01/11/2018) and (01/11/18). I wrote:

| eval LastSeen_epoch = strptime('LastSeen', "%m/%d/%Y %H:%M"),strptime('LastSeen', "%m/%d/%y %H:%M")

However, this does not work to convert both types that are coming in. (Y and y) are the differences.

Any ideas?

t_hartmann
Engager

Try wrapping your strptime calls in coalsece like this:

eval LastSeen_epoch = coalesce(strptime('LastSeen', "%m/%d/%Y %H:%M"),strptime('LastSeen', "%m/%d/%y %H:%M"))

This should return the epoch time for the first format which can be successfully used to parse LastSeen.

0 Karma

Vijeta
Influencer

Check the length of your "Last_date" field using len() function, if length is 8 then use %y format else if length is 10 use %Y format. Let me know if you need help forming the query.

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...