Strptime() Eval command returning empty

[olawalePS]

What is wrong with the query below, it does not return any value in the timestamp field. The attached image shows a result sample

index="jamf" sourcetype="jssUapiComputer:computerGeneral"
| dedup computer_meta.serial
| eval timestamp = strptime(computerGeneral.lastEnrolledDate, "%Y-%m-%dT%H:%M:%S.%3QZ")
| eval sixtyDaysAgo = relative_time(now(), "-60d") 
| table computer_meta.name, computerGeneral.lastEnrolledDate,timestamp, sixtyDaysAgo

Screenshot 2023-11-06 at 11.54.31.png

[gcusello · Accepted solution]

Hi @olawalePS,

try to rename the field:

index="jamf" sourcetype="jssUapiComputer:computerGeneral"
| dedup computer_meta.serial
| rename computerGeneral.lastEnrolledDate AS lastEnrolledDate
| eval timestamp = strptime(lastEnrolledDate, "%Y-%m-%dT%H:%M:%S.%3QZ")
| eval sixtyDaysAgo = relative_time(now(), "-60d") 
| table computer_meta.name, lastEnrolledDate,timestamp, sixtyDaysAgo

or using quotes (').

ciao.

Giuseppe

[olawalePS]

Thanks, it works, but do you know why it did not work previously, there is no space in the "computerGeneral.lastEnrolledDate" field

[gcusello]

Hi @olawalePS,

dot is a special char and sometimes requires the quotes or the rename.

Anyway, good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉