Splunk Search

Problem with strptime() when date is earlier than 1970

manus
Communicator

|eval DateMeasured="1900-01-01"

|eval DateMeasured=strftime(strptime(DateMeasured,"%Y-%m-%d"),"%d/%m/%Y")

Returns nothing. And I think it's because the date is before 1rst jan 1970.

Does somebody know how to make this work?

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this workaround.

|eval DateMeasured="1900-01-01" | eval DateMeasured=replace(DateMeasured,"^(\d{4})-(\d{1,2})-(\d{1,2})", "\3/\2/\1") 

View solution in original post

somesoni2
Revered Legend

Try this workaround.

|eval DateMeasured="1900-01-01" | eval DateMeasured=replace(DateMeasured,"^(\d{4})-(\d{1,2})-(\d{1,2})", "\3/\2/\1") 

manus
Communicator

Yes, that works!

0 Karma

manus
Communicator

As my question implied, I wanted to re-format it.
Thank you very much for the quick answer.

0 Karma

somesoni2
Revered Legend

Splunk only support date with epoch value greater than 0 (which is 01 Jan 1970 00:00:00 UTC). What do you intend to do with dates older than 1970?

Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...