Splunk Search

How do you use strptime with different date formats?


I have two date formats coming into my index (01/11/2018) and (01/11/18). I wrote:

| eval LastSeen_epoch = strptime('LastSeen', "%m/%d/%Y %H:%M"),strptime('LastSeen', "%m/%d/%y %H:%M")

However, this does not work to convert both types that are coming in. (Y and y) are the differences.

Any ideas?


Try wrapping your strptime calls in coalsece like this:

eval LastSeen_epoch = coalesce(strptime('LastSeen', "%m/%d/%Y %H:%M"),strptime('LastSeen', "%m/%d/%y %H:%M"))

This should return the epoch time for the first format which can be successfully used to parse LastSeen.

0 Karma


Check the length of your "Last_date" field using len() function, if length is 8 then use %y format else if length is 10 use %Y format. Let me know if you need help forming the query.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!