Time conversion for AWS Cloudtrail logs using strptime() and strftime() not working

[ezamit]

My original time format in the search is 

eventID: d7d2d438-cc61-4e74-9e9a-3fd8ae96388d
   eventName: StartInstances
   eventSource: ec2.amazonaws.com
   eventTime: 2024-01-30T05:00:27Z
   eventType: AwsApiCall

I am not able to convert it using the strptime function 

eval dt_year_epoc = strptime(eventTime, "%Y-%m-%dThh:mm:ssZ")

eval dt_day= strftime(dt_year_epoc, "%d")

Nothing comes up in dt_day

[amitshrigoel]

Thanks. I was able to use strptime and convert it to Epoch and use strftime to the format i wanted. Thank you. 

[yuanliu]

Is the semantic meaning of of dt_day day of year?  For that, Splunk uses %j. (%d is day of month.  But you cannot have day of month without month.)  Meanwhile, it is much better to simply convert the entire eventTime to epoc.

| makeresults format=csv data="eventTime
2024-01-30T05:00:27Z"
``` data emulation above ```
| eval eventTime = strptime(eventTime, "%Y-%m-%dT%H:%M:%SZ")
| eval dt_day = strftime(eventTime, "%j")
| fieldformat eventTime = strftime(eventTime, "%F %T")

For this you get

dt_day	eventTime
030	2024-01-30 05:00:27

But if you really want day of month without month, you can skip all the conversion and treat eventTime as a simple string.

| makeresults format=csv data="eventTime
2024-01-30T05:00:27Z"
``` data emulation above ```
| eval dt_year = mvindex(split(eventTime, "T"), 0)
| eval dt_day = mvindex(split(dt_year, "-"), -1)

This gives you

dt_day	dt_year	eventTime
30	2024-01-30	2024-01-30T05:00:27Z

Hope this helps.