Please use Time Variables and derive strptime time variables for me.

[rajagurup]

Some events have time as string as "Tue Jun 12 00:00:00 CDT 2018" and some have "Fri Nov 16 00:00:00 CST 2018" in ENDDATE field. Can data have different timezones in events?

If yes I wrote strptime as eval "End Date"=strptime('ENDDATE',"%d %b %a %H:%M:%S %Z %Y"). It is not working. Please help.

[woodcock]

Like this:

| makeresults 
| eval ENDDATE="Tue Jun 12 00:00:00 CDT 2018" 
| fields - _time 
| eval "EndDate"=strptime(ENDDATE,"%a %b %d %H:%M:%S %Z %Y")

[arjunpkishore5]

Based on your sample, this should work for you

| eval "End Date" = strptime(ENDDATE, "%a %b %e %T %Z %Y")

[richgalloway]

Yes, different timezones are allowed. CST and CDT are the same time zone, just adjusted for summer time (CST).

Your time format string doesn't match your sample dates. Try %a %b %d %H:%M:%S %Z %Y.