Splunk Search

Problem with strptime() when date is earlier than 1970

manus
Communicator

|eval DateMeasured="1900-01-01"

|eval DateMeasured=strftime(strptime(DateMeasured,"%Y-%m-%d"),"%d/%m/%Y")

Returns nothing. And I think it's because the date is before 1rst jan 1970.

Does somebody know how to make this work?

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this workaround.

|eval DateMeasured="1900-01-01" | eval DateMeasured=replace(DateMeasured,"^(\d{4})-(\d{1,2})-(\d{1,2})", "\3/\2/\1") 

View solution in original post

somesoni2
Revered Legend

Try this workaround.

|eval DateMeasured="1900-01-01" | eval DateMeasured=replace(DateMeasured,"^(\d{4})-(\d{1,2})-(\d{1,2})", "\3/\2/\1") 

manus
Communicator

Yes, that works!

0 Karma

manus
Communicator

As my question implied, I wanted to re-format it.
Thank you very much for the quick answer.

0 Karma

somesoni2
Revered Legend

Splunk only support date with epoch value greater than 0 (which is 01 Jan 1970 00:00:00 UTC). What do you intend to do with dates older than 1970?

Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...