Strptime statement not extracting date/time

[svercelli]

I've been trying to import the data into splunk and have been unable to get the time/date to work. Included is a screenshot. Any help is appreciated

[svercelli · Accepted solution]

Found that %m/%e/%y %k:%M worked.

[woodcock]

It should be this:

%m/%d/%Y %H:%M

[lguinn2]

%Y is a 4-digit year

%y is the 2-digit year

[woodcock]

Missed it by that much!

[michael_kushma]

Can you type out your Timestamp format. It's VERY hard to read.

My guess is that there line break in that field you're trying to extract from.

I also don't see an AM or PM so you shouldn't be using %p at all.

Should be: %m/%d/%Y %k:%M

[somesoni2]

Could you provide the other configuration that you're using here, is this a structured format file (PSV/CSV/TSV etc)?

[svercelli]

its a csv.

[somesoni2]

Well, I did some testing with sample CSV data and looks like the time format is the issue. The TIME format should be exactly same as what's in the "Start Date" field. So try timestamp format as "%m/%d/%Y %H:%M"

[richgalloway]

The screen shot is not visible. Try pasting some sample data as well as the strptime() strings you've tried.

[svercelli]

The time I'm trying to base it on is the Start Date.

[richgalloway]

I don't see a Start Date. There is no screen shot or sample data.

[svercelli]

[sk314]

Did you try Auto Extraction?

[svercelli]

yes. no luck.