Splunk Search

Strptime statement not extracting date/time

svercelli
Path Finder

I've been trying to import the data into splunk and have been unable to get the time/date to work. Included is a screenshot. Any help is appreciatedalt text

0 Karma
1 Solution

svercelli
Path Finder

Found that %m/%e/%y %k:%M worked.

View solution in original post

0 Karma

svercelli
Path Finder

Found that %m/%e/%y %k:%M worked.

0 Karma

woodcock
Esteemed Legend

It should be this:

%m/%d/%Y %H:%M
0 Karma

lguinn2
Legend

%Y is a 4-digit year

%y is the 2-digit year

0 Karma

woodcock
Esteemed Legend

Missed it by that much!

0 Karma

michael_kushma
Path Finder

Can you type out your Timestamp format. It's VERY hard to read.

My guess is that there line break in that field you're trying to extract from.

I also don't see an AM or PM so you shouldn't be using %p at all.

Should be: %m/%d/%Y %k:%M

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Could you provide the other configuration that you're using here, is this a structured format file (PSV/CSV/TSV etc)?

svercelli
Path Finder

its a csv.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Well, I did some testing with sample CSV data and looks like the time format is the issue. The TIME format should be exactly same as what's in the "Start Date" field. So try timestamp format as "%m/%d/%Y %H:%M"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The screen shot is not visible. Try pasting some sample data as well as the strptime() strings you've tried.

---
If this reply helps you, Karma would be appreciated.
0 Karma

svercelli
Path Finder

The time I'm trying to base it on is the Start Date.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I don't see a Start Date. There is no screen shot or sample data.

---
If this reply helps you, Karma would be appreciated.
0 Karma

svercelli
Path Finder

Here it is

0 Karma

sk314
Builder

Did you try Auto Extraction?

0 Karma

svercelli
Path Finder

yes. no luck.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...