Splunk Search

Strptime statement not extracting date/time

svercelli
Path Finder

I've been trying to import the data into splunk and have been unable to get the time/date to work. Included is a screenshot. Any help is appreciatedalt text

0 Karma
1 Solution

svercelli
Path Finder

Found that %m/%e/%y %k:%M worked.

View solution in original post

0 Karma

svercelli
Path Finder

Found that %m/%e/%y %k:%M worked.

0 Karma

woodcock
Esteemed Legend

It should be this:

%m/%d/%Y %H:%M
0 Karma

lguinn2
Legend

%Y is a 4-digit year

%y is the 2-digit year

0 Karma

woodcock
Esteemed Legend

Missed it by that much!

0 Karma

michael_kushma
Path Finder

Can you type out your Timestamp format. It's VERY hard to read.

My guess is that there line break in that field you're trying to extract from.

I also don't see an AM or PM so you shouldn't be using %p at all.

Should be: %m/%d/%Y %k:%M

0 Karma

somesoni2
Revered Legend

Could you provide the other configuration that you're using here, is this a structured format file (PSV/CSV/TSV etc)?

svercelli
Path Finder

its a csv.

0 Karma

somesoni2
Revered Legend

Well, I did some testing with sample CSV data and looks like the time format is the issue. The TIME format should be exactly same as what's in the "Start Date" field. So try timestamp format as "%m/%d/%Y %H:%M"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The screen shot is not visible. Try pasting some sample data as well as the strptime() strings you've tried.

---
If this reply helps you, Karma would be appreciated.
0 Karma

svercelli
Path Finder

The time I'm trying to base it on is the Start Date.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I don't see a Start Date. There is no screen shot or sample data.

---
If this reply helps you, Karma would be appreciated.
0 Karma

svercelli
Path Finder

Here it is

0 Karma

sk314
Builder

Did you try Auto Extraction?

0 Karma

svercelli
Path Finder

yes. no luck.

0 Karma
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...