Splunk Search

How to combine a date (dd-mm-yyyy) and time (HH:MM) field into a combined field with the format "yyyy-mm-dd HH:MM"?

IRHM73
Motivator

Hi,

I wonder whether someone could help me please.

I'm trying to combine two fields Submission Date and Submission Time

Submission Date is in the format dd-mm-yyyy and Submission Time is in the format HH:MM.

I'd like to create a combined field so that the format is yyyy-mm-dd HH:MM.

I just wondered whether someone may be able to help me with this please.

Many thanks and kind regards

Chris

0 Karma

gfuente
Motivator

Hello

You can do this easily with eval command

... | eval time= Submission_Date. " ". Submission_Time | ...

I rename the original field names to avoid issues with the quotes

Regards

0 Karma

IRHM73
Motivator

Hi @gfuente, thank you for taking the time to come back to me with this.

I had already tried what you had kindly suggested (my apologies for not highlighting this), but for some reason it will not join the fields and it also doesn't take into account the change in format which I need.

Many thanks and kind regards

Chris

0 Karma

gfuente
Motivator

Ok, sorry i miss the changing format part.

Then you need to concatenate both string as i suggested. Then parse the date to epoch with this

eval time = strptime(time, "%d-%m-%Y %H:%M")

And then change it again to the format you need with this:

eval time = strftime(time, "%Y-%m-%d %H:%M")

Actually you can do all in the same eval command

Regards

0 Karma

IRHM73
Motivator

Hi, thank you for coming back to me with this.

I've tried the code you kindly provided so this part of my query is now:

eval time= detail.SubmissionDate." ". detail.SubmissionTime |  eval time = strptime(time, "%d-%m-%Y %H:%M") | eval time = strftime(time, "%Y-%m-%d %H:%M")

But when I then try to use 'time' in my table the field is blank. This was the same issue when I used eval time= detail.SubmissionDate." ". detail.SubmissionTime | by itself.

Many thanks and kind regards

Chris

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...