Roman date parsing

[vanvan]

Hi,
I have a log with the following datetime format:
03 IV 2018 23:03:53.014

I am trying to parse it, but I am failing to succeed...
The format I am using during import of the file is the following:
%d %Om %Y %H:%M:%S

Thanks in advance!

[cmerriman · Accepted solution]

Splunk doesn't support Roman Numeral conversions. Perhaps suggest that as a feature request in the Splunk Support Portal. My suggestion is to replace the Roman Numerals with numbers and then create the date. something like this should work. Use the replace command and change the in date with your field name.

|makeresults|eval date="03 IV 2018 23:03:53.014"|replace "*I*" with *01* "*II*" with *02* "*III*" with *03* "*IV*" with *04* "*V*" with *05* "*VI*" with *06* "*VII*" with *07* "*VIII*" with *08* "*IX*" with *09* "*X*" with *10* "*XI*" with *11* "*XII*" with *12* in date|eval date2=strptime(date,"%d %m %Y %H:%M:%S")