Splunk Search

Strptime() Eval command returning empty

olawalePS
Path Finder

What is wrong with the query below, it does not return any value in the timestamp field. The attached image shows a result sample

index="jamf" sourcetype="jssUapiComputer:computerGeneral"
| dedup computer_meta.serial
| eval timestamp = strptime(computerGeneral.lastEnrolledDate, "%Y-%m-%dT%H:%M:%S.%3QZ")
| eval sixtyDaysAgo = relative_time(now(), "-60d") 
| table computer_meta.name, computerGeneral.lastEnrolledDate,timestamp, sixtyDaysAgo




Screenshot 2023-11-06 at 11.54.31.png

 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @olawalePS,

try to rename the field:

index="jamf" sourcetype="jssUapiComputer:computerGeneral"
| dedup computer_meta.serial
| rename computerGeneral.lastEnrolledDate AS lastEnrolledDate
| eval timestamp = strptime(lastEnrolledDate, "%Y-%m-%dT%H:%M:%S.%3QZ")
| eval sixtyDaysAgo = relative_time(now(), "-60d") 
| table computer_meta.name, lastEnrolledDate,timestamp, sixtyDaysAgo

or using quotes (').

ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @olawalePS,

try to rename the field:

index="jamf" sourcetype="jssUapiComputer:computerGeneral"
| dedup computer_meta.serial
| rename computerGeneral.lastEnrolledDate AS lastEnrolledDate
| eval timestamp = strptime(lastEnrolledDate, "%Y-%m-%dT%H:%M:%S.%3QZ")
| eval sixtyDaysAgo = relative_time(now(), "-60d") 
| table computer_meta.name, lastEnrolledDate,timestamp, sixtyDaysAgo

or using quotes (').

ciao.

Giuseppe

olawalePS
Path Finder

Thanks, it works, but do you know why it did not work previously, there is no space in the "computerGeneral.lastEnrolledDate" field

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @olawalePS,

dot is a special char and sometimes requires the quotes or the rename.

Anyway, good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...