Splunk Search

Splint date/time filed in multiple fields for calculations

bigll
Path Finder

Hi.

I have a single filed for date and time of event - 2024-02-19T11:16:58.930104Z
I would like to have to fields Date and Time as well as one more calculated fields I can use to find records not changed in last 2 days or 48 hours what ever is better for the search.

I tried 

|eval Date = strftime(policy_refresh_at, "%b-%d-%Y")

| eval Time = strftime(policy_refresh_at, "%H:%M")

or

| eval Date=substr(policy_refresh,10,1)

The result come empty in both cases.
So nothing to calculate on

Please advise, Thank you

Please advise on

Labels (1)
Tags (3)
0 Karma

bigll
Path Finder

Thank you for an update.

I tried suggested SPL and added rename field to see if data exists
-------------------
| eval Date = strftime(strptime("policy_applied_at","%FT%T.%6NZ"), "%b-%d-%Y")
| eval Time = strftime(strptime("policy_applied_at","%FT%T.%6NZ"), "%H:%M")
| rename "policy_applied_at" as "Last Refresh Time"
| table "Last Refresh Time", Date, Time
-------------
The rename, but not trimmed field has data, other two are empty

Last Refresh Time Date Time

2024-02-19T11:16:58.930104Z  
2024-02-19T11:16:54.980418Z  
2024-02-19T11:18:44.875386Z  
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share some sample (anonymised) events

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If policy_refresh_at is a string, you could ty parsing it (to an epoch timestamp) before formatting, something like this:

|eval Date = strftime(strptime(policy_refresh_at,"%FT%T.%6NZ"), "%b-%d-%Y")

| eval Time = strftime(strptime(policy_refresh_at,"%FT%T.%6NZ"), "%H:%M")
0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...