Splunk Search

How to convert an invalid field to a date?

tcupp
New Member

index=pltwg_shopflex
| eval Time=typeof(event.InventoryEventCarpet.InventoryEventCreateDateTime)
"http://cimsplunk/en-US/app/Plant_WG/ols_production_report_clone/edit"

Typeof for "event.InventoryEventCarpet.InventoryEventCreateDateTime" returns "invalid" as the format.

This is the field "event.InventoryEventCarpet.InventoryEventCreateDateTime =2018-06-07T15:44:03.570".

I want to convert this to a date, then to a week ending field and need help.

Tags (1)
0 Karma

kmaron
Motivator

does it work if you put single quotes around the field?

| eval Time=typeof('event.InventoryEventCarpet.InventoryEventCreateDateTime')
0 Karma

tcupp
New Member

Yes, it comes back as a string. Thanks for helping, have a great week end!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...