Splunk Search

Issue with strptime

efelder0
Communicator

I am trying to reformat a date field in Splunk. I have a field called "last_updated_date" and its value is 2012-04-03.

I am using the strptime command to reformat the field to the following: 04/03/12.
Here is my syntax:
eval last_updated_date=strftime(strptime(last_updated_date,"%Y-%b-%D"),"%M/%D/%Y")

However, it returns blank values in my output.

Thoughts?

Tags (1)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

There's (at least) two ways of dealing with this. If you want to change the raw data within the event as it is being indexed then as cvajs suggested, SEDCMD is the route to take. It would look something like this:

[mysourcetype]
SEDCMD-date=s/\d{2}(\d{2})-(\d{2})-(\d{2})/\2\/\3\/\1/

(Assuming I got my sed syntax 100% correct)

Your strftime + strptime approach should work as well. It obviously does not change the data in the index, but it should update the field correctly. But, I think you have your format strings wrong:

... | eval last_updated_date=strftime(strptime(last_updated_date,"%Y-%m-%d"),"%m/%d/%y")

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

There's (at least) two ways of dealing with this. If you want to change the raw data within the event as it is being indexed then as cvajs suggested, SEDCMD is the route to take. It would look something like this:

[mysourcetype]
SEDCMD-date=s/\d{2}(\d{2})-(\d{2})-(\d{2})/\2\/\3\/\1/

(Assuming I got my sed syntax 100% correct)

Your strftime + strptime approach should work as well. It obviously does not change the data in the index, but it should update the field correctly. But, I think you have your format strings wrong:

... | eval last_updated_date=strftime(strptime(last_updated_date,"%Y-%m-%d"),"%m/%d/%y")

cvajs
Contributor

i think SEDCMD is a better route

0 Karma

efelder0
Communicator

I am looking to reformat the date to MM/DD/YYYY. Should this be done in props instead?

0 Karma

efelder0
Communicator

so, maybe strptime would not be useful in this scenario?

0 Karma

cvajs
Contributor

you wrote "strftime"
is that the right command?
strftime takes (X) as epoch time and converts it to format Y

you dont have epoch time anywhere in your syntax. epoch is # of sec since jan 1 1970 00:00:00 UTC

http://docs.splunk.com/Documentation/Splunk/4.3.1/SearchReference/CommonEvalFunctions

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...