How to convert time from an upload csv to Splunk readable format

[phamxuantung]

I have a csv file that I upload through Lookup Editor which have a Time column in this format

15/06/2021 14:35:00

I want to convert it to Splunk readable time or an Unix time format so I can filter out the row between two certain date (between 14/06/2021 and 7/7/2021).

I have try

|inputlookup sample.csv
|eval time = strptime(Time,"%m/%d/%Y %I:%M:%S %p")
|table time 

But it return "No result found".

How do I go about this? Or my strptime have any errors in formatting?

[mayurr98]

Hi its because you are using wrong time format:

use this:

| eval time = strptime(Time,"%d/%m/%Y %H:%M:%S")

Accept/upvote if this helps!

[PickleRick]

Apparently either your lookup doesn't have field called Time or you gave wrong time format to strptime (which you did - there is no " %p" part in there for sure).

[phamxuantung]

My csv file do have a 'Time' field, and even when I change my eval to

eval time = strptime(Time, "%m/%d/%Y %H:%M:%S")

it still return nothing as show below.

[yuanliu]

Based on the sample data and screenshot, I am convinced that the first number is %d and the second is %m.

| eval time = strptime(Time, "%d/%m/%Y %H:%M:%S")