Splunk Search

Please use Time Variables and derive strptime time variables for me.

New Member

Some events have time as string as "Tue Jun 12 00:00:00 CDT 2018" and some have "Fri Nov 16 00:00:00 CST 2018" in ENDDATE field. Can data have different timezones in events?

If yes I wrote strptime as eval "End Date"=strptime('ENDDATE',"%d %b %a %H:%M:%S %Z %Y"). It is not working. Please help.

Tags (1)
0 Karma

Esteemed Legend

Like this:

| makeresults 
| eval ENDDATE="Tue Jun 12 00:00:00 CDT 2018" 
| fields - _time 
| eval "EndDate"=strptime(ENDDATE,"%a %b %d %H:%M:%S %Z %Y")
0 Karma


Based on your sample, this should work for you

| eval "End Date" = strptime(ENDDATE, "%a %b %e %T %Z %Y")
0 Karma


Yes, different timezones are allowed. CST and CDT are the same time zone, just adjusted for summer time (CST).

Your time format string doesn't match your sample dates. Try %a %b %d %H:%M:%S %Z %Y.

If this reply helps you, an upvote would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!