Splunk Search

Time conversion for AWS Cloudtrail logs using strptime() and strftime() not working

ezamit
Explorer

My original time format in the search is 

eventID: d7d2d438-cc61-4e74-9e9a-3fd8ae96388d
   eventName: StartInstances
   eventSource: ec2.amazonaws.com
   eventTime2024-01-30T05:00:27Z
   eventType: AwsApiCall

I am not able to convert it using the strptime function 

eval dt_year_epoc = strptime(eventTime, "%Y-%m-%dThh:mm:ssZ")

eval dt_day= strftime(dt_year_epoc, "%d")

Nothing comes up in dt_day

 

 

 

Labels (1)
0 Karma

amitshrigoel
Explorer

Thanks. I was able to use strptime and convert it to Epoch and use strftime to the format i wanted. Thank you. 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Is the semantic meaning of of dt_day day of year?  For that, Splunk uses %j. (%d is day of month.  But you cannot have day of month without month.)  Meanwhile, it is much better to simply convert the entire eventTime to epoc.

 

| makeresults format=csv data="eventTime
2024-01-30T05:00:27Z"
``` data emulation above ```
| eval eventTime = strptime(eventTime, "%Y-%m-%dT%H:%M:%SZ")
| eval dt_day = strftime(eventTime, "%j")
| fieldformat eventTime = strftime(eventTime, "%F %T")

 

For this you get

dt_dayeventTime
0302024-01-30 05:00:27

But if you really want day of month without month, you can skip all the conversion and treat eventTime as a simple string.

 

| makeresults format=csv data="eventTime
2024-01-30T05:00:27Z"
``` data emulation above ```
| eval dt_year = mvindex(split(eventTime, "T"), 0)
| eval dt_day = mvindex(split(dt_year, "-"), -1)

 

This gives you

dt_daydt_yeareventTime
302024-01-302024-01-30T05:00:27Z

Hope this helps. 

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...