Splunk Search

How to assign dates using eval

raghu0463
Explorer

Hi,
Here I want to assign Initial_L1_Decision_Date dates to Queue_to_Initial_L1_Days. There are some dates for Initial_L1_Decision_Date, but the table for Queue_to_Initial_L1_Days does not show any dates, I'm getting all blanks.

index = index_T1 source= Source_E1 sourcetype = SourceType_E1 |eval Queue_to_Initial_L1_Days = strftime(Initial_L1_Decision_Date, "%Y-%M-%D %H:%M:%S") |table Queue_to_Initial_L1_Days

Thanks

0 Karma

DalJeanis
Legend

Be sure to mark code as code.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Is Initial_L1_Decision_Date in epoch form? There's a typo in the strftime format string. Try "%Y-%m-%d %H:%M:%S".

---
If this reply helps you, Karma would be appreciated.

DalJeanis
Legend

@raghu0463 - I moved this comment to answer because it's the answer.

Use "%Y-%m-%d %H:%M:%S"
Month is %m, not %M
Day is %d, not %D

0 Karma

ddrillic
Ultra Champion

Sample data maybe ; - )

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...