How do you use strptime with different date formats?

[JoshuaJohn]

I have two date formats coming into my index (01/11/2018) and (01/11/18). I wrote:

| eval LastSeen_epoch = strptime('LastSeen', "%m/%d/%Y %H:%M"),strptime('LastSeen', "%m/%d/%y %H:%M")

However, this does not work to convert both types that are coming in. (Y and y) are the differences.

Any ideas?

[t_hartmann]

Try wrapping your strptime calls in coalsece like this:

eval LastSeen_epoch = coalesce(strptime('LastSeen', "%m/%d/%Y %H:%M"),strptime('LastSeen', "%m/%d/%y %H:%M"))

This should return the epoch time for the first format which can be successfully used to parse LastSeen.

[Vijeta]

Check the length of your "Last_date" field using len() function, if length is 8 then use %y format else if length is 10 use %Y format. Let me know if you need help forming the query.