Splunk Search

Strptime() Eval command returning empty

olawalePS
Path Finder

What is wrong with the query below, it does not return any value in the timestamp field. The attached image shows a result sample

index="jamf" sourcetype="jssUapiComputer:computerGeneral"
| dedup computer_meta.serial
| eval timestamp = strptime(computerGeneral.lastEnrolledDate, "%Y-%m-%dT%H:%M:%S.%3QZ")
| eval sixtyDaysAgo = relative_time(now(), "-60d") 
| table computer_meta.name, computerGeneral.lastEnrolledDate,timestamp, sixtyDaysAgo




Screenshot 2023-11-06 at 11.54.31.png

 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @olawalePS,

try to rename the field:

index="jamf" sourcetype="jssUapiComputer:computerGeneral"
| dedup computer_meta.serial
| rename computerGeneral.lastEnrolledDate AS lastEnrolledDate
| eval timestamp = strptime(lastEnrolledDate, "%Y-%m-%dT%H:%M:%S.%3QZ")
| eval sixtyDaysAgo = relative_time(now(), "-60d") 
| table computer_meta.name, lastEnrolledDate,timestamp, sixtyDaysAgo

or using quotes (').

ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @olawalePS,

try to rename the field:

index="jamf" sourcetype="jssUapiComputer:computerGeneral"
| dedup computer_meta.serial
| rename computerGeneral.lastEnrolledDate AS lastEnrolledDate
| eval timestamp = strptime(lastEnrolledDate, "%Y-%m-%dT%H:%M:%S.%3QZ")
| eval sixtyDaysAgo = relative_time(now(), "-60d") 
| table computer_meta.name, lastEnrolledDate,timestamp, sixtyDaysAgo

or using quotes (').

ciao.

Giuseppe

olawalePS
Path Finder

Thanks, it works, but do you know why it did not work previously, there is no space in the "computerGeneral.lastEnrolledDate" field

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @olawalePS,

dot is a special char and sometimes requires the quotes or the rename.

Anyway, good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...