Splunk Search

Please use Time Variables and derive strptime time variables for me.

rajagurup
New Member

Some events have time as string as "Tue Jun 12 00:00:00 CDT 2018" and some have "Fri Nov 16 00:00:00 CST 2018" in ENDDATE field. Can data have different timezones in events?

If yes I wrote strptime as eval "End Date"=strptime('ENDDATE',"%d %b %a %H:%M:%S %Z %Y"). It is not working. Please help.

Tags (1)
0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval ENDDATE="Tue Jun 12 00:00:00 CDT 2018" 
| fields - _time 
| eval "EndDate"=strptime(ENDDATE,"%a %b %d %H:%M:%S %Z %Y")
0 Karma

arjunpkishore5
Motivator

Based on your sample, this should work for you

| eval "End Date" = strptime(ENDDATE, "%a %b %e %T %Z %Y")
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, different timezones are allowed. CST and CDT are the same time zone, just adjusted for summer time (CST).

Your time format string doesn't match your sample dates. Try %a %b %d %H:%M:%S %Z %Y.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...