Splunk Search

Please use Time Variables and derive strptime time variables for me.

rajagurup
New Member

Some events have time as string as "Tue Jun 12 00:00:00 CDT 2018" and some have "Fri Nov 16 00:00:00 CST 2018" in ENDDATE field. Can data have different timezones in events?

If yes I wrote strptime as eval "End Date"=strptime('ENDDATE',"%d %b %a %H:%M:%S %Z %Y"). It is not working. Please help.

Tags (1)
0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval ENDDATE="Tue Jun 12 00:00:00 CDT 2018" 
| fields - _time 
| eval "EndDate"=strptime(ENDDATE,"%a %b %d %H:%M:%S %Z %Y")
0 Karma

arjunpkishore5
Motivator

Based on your sample, this should work for you

| eval "End Date" = strptime(ENDDATE, "%a %b %e %T %Z %Y")
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, different timezones are allowed. CST and CDT are the same time zone, just adjusted for summer time (CST).

Your time format string doesn't match your sample dates. Try %a %b %d %H:%M:%S %Z %Y.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!