Splunk Search

Strptime bug?

ARothman
Path Finder

Has anyone else noticed that strptime does not work in the following situation?

VersionExpiry has a value of 9999-01-01 00:00:00 (or with any year greater than 2999)

eval VersionExpiryEpoch=strptime(VersionExpiry, "%Y-%m-%d %H:%M:%S")

Field "VersionExpiryEpoch" is never created


Does anyone have any workaround ideas to force Splunk in recognizing that existence may, in fact, continue past the year 2999? 😉

The raw data Splunk is receiving is indicating that the version, as of this moment, does not have an expiration date... hence the year 9999. I could, easily, hardcode it in the query that a value of 9999-01-01 00:00:00 means that the version is up to date, but I'd prefer that the function worked correctly.

Tags (1)
0 Karma
1 Solution

dart
Splunk Employee
Splunk Employee

If you just need it to work on that specific far future date, then you could do something like this:

search goes here | eval VersionExpiryEpoch = coalesce(strptime(VersionExpiry, "%Y-%m-%d %H:%M:%S"), 253370786400)

View solution in original post

dart
Splunk Employee
Splunk Employee

If you just need it to work on that specific far future date, then you could do something like this:

search goes here | eval VersionExpiryEpoch = coalesce(strptime(VersionExpiry, "%Y-%m-%d %H:%M:%S"), 253370786400)

ARothman
Path Finder

Seems to have done the trick - thanks.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...