Splunk Search

How to convert an invalid field to a date?

tcupp
New Member

index=pltwg_shopflex
| eval Time=typeof(event.InventoryEventCarpet.InventoryEventCreateDateTime)
"http://cimsplunk/en-US/app/Plant_WG/ols_production_report_clone/edit"

Typeof for "event.InventoryEventCarpet.InventoryEventCreateDateTime" returns "invalid" as the format.

This is the field "event.InventoryEventCarpet.InventoryEventCreateDateTime =2018-06-07T15:44:03.570".

I want to convert this to a date, then to a week ending field and need help.

Tags (1)
0 Karma

kmaron
Motivator

does it work if you put single quotes around the field?

| eval Time=typeof('event.InventoryEventCarpet.InventoryEventCreateDateTime')
0 Karma

tcupp
New Member

Yes, it comes back as a string. Thanks for helping, have a great week end!

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...