Some events have time as string as "Tue Jun 12 00:00:00 CDT 2018" and some have "Fri Nov 16 00:00:00 CST 2018" in ENDDATE field. Can data have different timezones in events?
If yes I wrote strptime as eval "End Date"=strptime('ENDDATE',"%d %b %a %H:%M:%S %Z %Y"). It is not working. Please help.
Like this:
| makeresults
| eval ENDDATE="Tue Jun 12 00:00:00 CDT 2018"
| fields - _time
| eval "EndDate"=strptime(ENDDATE,"%a %b %d %H:%M:%S %Z %Y")
Based on your sample, this should work for you
| eval "End Date" = strptime(ENDDATE, "%a %b %e %T %Z %Y")
Yes, different timezones are allowed. CST and CDT are the same time zone, just adjusted for summer time (CST).
Your time format string doesn't match your sample dates. Try %a %b %d %H:%M:%S %Z %Y
.