Splunk Search

Roman date parsing

vanvan
Path Finder

Hi,
I have a log with the following datetime format:
03 IV 2018 23:03:53.014

I am trying to parse it, but I am failing to succeed...
The format I am using during import of the file is the following:
%d %Om %Y %H:%M:%S

Thanks in advance!

Tags (2)
0 Karma
1 Solution

cmerriman
Super Champion

Splunk doesn't support Roman Numeral conversions. Perhaps suggest that as a feature request in the Splunk Support Portal. My suggestion is to replace the Roman Numerals with numbers and then create the date. something like this should work. Use the replace command and change the in date with your field name.

|makeresults|eval date="03 IV 2018 23:03:53.014"|replace "*I*" with *01* "*II*" with *02* "*III*" with *03* "*IV*" with *04* "*V*" with *05* "*VI*" with *06* "*VII*" with *07* "*VIII*" with *08* "*IX*" with *09* "*X*" with *10* "*XI*" with *11* "*XII*" with *12* in date|eval date2=strptime(date,"%d %m %Y %H:%M:%S")

View solution in original post

cmerriman
Super Champion

Splunk doesn't support Roman Numeral conversions. Perhaps suggest that as a feature request in the Splunk Support Portal. My suggestion is to replace the Roman Numerals with numbers and then create the date. something like this should work. Use the replace command and change the in date with your field name.

|makeresults|eval date="03 IV 2018 23:03:53.014"|replace "*I*" with *01* "*II*" with *02* "*III*" with *03* "*IV*" with *04* "*V*" with *05* "*VI*" with *06* "*VII*" with *07* "*VIII*" with *08* "*IX*" with *09* "*X*" with *10* "*XI*" with *11* "*XII*" with *12* in date|eval date2=strptime(date,"%d %m %Y %H:%M:%S")
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...