Splunk Search

Strptime statement not extracting date/time

svercelli
Path Finder

I've been trying to import the data into splunk and have been unable to get the time/date to work. Included is a screenshot. Any help is appreciatedalt text

0 Karma
1 Solution

svercelli
Path Finder

Found that %m/%e/%y %k:%M worked.

View solution in original post

0 Karma

svercelli
Path Finder

Found that %m/%e/%y %k:%M worked.

0 Karma

woodcock
Esteemed Legend

It should be this:

%m/%d/%Y %H:%M
0 Karma

lguinn2
Legend

%Y is a 4-digit year

%y is the 2-digit year

0 Karma

woodcock
Esteemed Legend

Missed it by that much!

0 Karma

michael_kushma
Path Finder

Can you type out your Timestamp format. It's VERY hard to read.

My guess is that there line break in that field you're trying to extract from.

I also don't see an AM or PM so you shouldn't be using %p at all.

Should be: %m/%d/%Y %k:%M

0 Karma

somesoni2
Revered Legend

Could you provide the other configuration that you're using here, is this a structured format file (PSV/CSV/TSV etc)?

svercelli
Path Finder

its a csv.

0 Karma

somesoni2
Revered Legend

Well, I did some testing with sample CSV data and looks like the time format is the issue. The TIME format should be exactly same as what's in the "Start Date" field. So try timestamp format as "%m/%d/%Y %H:%M"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The screen shot is not visible. Try pasting some sample data as well as the strptime() strings you've tried.

---
If this reply helps you, Karma would be appreciated.
0 Karma

svercelli
Path Finder

The time I'm trying to base it on is the Start Date.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I don't see a Start Date. There is no screen shot or sample data.

---
If this reply helps you, Karma would be appreciated.
0 Karma

svercelli
Path Finder

Here it is

0 Karma

sk314
Builder

Did you try Auto Extraction?

0 Karma

svercelli
Path Finder

yes. no luck.

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...