Splunk Search

Issue with strptime

efelder0
Communicator

I am trying to reformat a date field in Splunk. I have a field called "last_updated_date" and its value is 2012-04-03.

I am using the strptime command to reformat the field to the following: 04/03/12.
Here is my syntax:
eval last_updated_date=strftime(strptime(last_updated_date,"%Y-%b-%D"),"%M/%D/%Y")

However, it returns blank values in my output.

Thoughts?

Tags (1)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

There's (at least) two ways of dealing with this. If you want to change the raw data within the event as it is being indexed then as cvajs suggested, SEDCMD is the route to take. It would look something like this:

[mysourcetype]
SEDCMD-date=s/\d{2}(\d{2})-(\d{2})-(\d{2})/\2\/\3\/\1/

(Assuming I got my sed syntax 100% correct)

Your strftime + strptime approach should work as well. It obviously does not change the data in the index, but it should update the field correctly. But, I think you have your format strings wrong:

... | eval last_updated_date=strftime(strptime(last_updated_date,"%Y-%m-%d"),"%m/%d/%y")

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

There's (at least) two ways of dealing with this. If you want to change the raw data within the event as it is being indexed then as cvajs suggested, SEDCMD is the route to take. It would look something like this:

[mysourcetype]
SEDCMD-date=s/\d{2}(\d{2})-(\d{2})-(\d{2})/\2\/\3\/\1/

(Assuming I got my sed syntax 100% correct)

Your strftime + strptime approach should work as well. It obviously does not change the data in the index, but it should update the field correctly. But, I think you have your format strings wrong:

... | eval last_updated_date=strftime(strptime(last_updated_date,"%Y-%m-%d"),"%m/%d/%y")

cvajs
Contributor

i think SEDCMD is a better route

0 Karma

efelder0
Communicator

I am looking to reformat the date to MM/DD/YYYY. Should this be done in props instead?

0 Karma

efelder0
Communicator

so, maybe strptime would not be useful in this scenario?

0 Karma

cvajs
Contributor

you wrote "strftime"
is that the right command?
strftime takes (X) as epoch time and converts it to format Y

you dont have epoch time anywhere in your syntax. epoch is # of sec since jan 1 1970 00:00:00 UTC

http://docs.splunk.com/Documentation/Splunk/4.3.1/SearchReference/CommonEvalFunctions

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...