Splunk Search
Highlighted

How to assign dates using eval

Explorer

Hi,
Here I want to assign Initial_L1_Decision_Date dates to Queue_to_Initial_L1_Days. There are some dates for Initial_L1_Decision_Date, but the table for Queue_to_Initial_L1_Days does not show any dates, I'm getting all blanks.

index = index_T1 source= Source_E1 sourcetype = SourceType_E1 |eval Queue_to_Initial_L1_Days = strftime(Initial_L1_Decision_Date, "%Y-%M-%D %H:%M:%S") |table Queue_to_Initial_L1_Days

Thanks

0 Karma
Highlighted

Re: How to assign dates using eval

Ultra Champion

Sample data maybe ; - )

0 Karma
Highlighted

Re: How to assign dates using eval

SplunkTrust
SplunkTrust

Is InitialL1Decision_Date in epoch form? There's a typo in the strftime format string. Try "%Y-%m-%d %H:%M:%S".

---
If this reply helps you, an upvote would be appreciated.
Highlighted

Re: How to assign dates using eval

SplunkTrust
SplunkTrust

@raghu0463 - I moved this comment to answer because it's the answer.

Use "%Y-%m-%d %H:%M:%S"
Month is %m, not %M
Day is %d, not %D

0 Karma
Highlighted

Re: How to assign dates using eval

SplunkTrust
SplunkTrust

Be sure to mark code as code.

0 Karma