Splunk Search

Time conversion for AWS Cloudtrail logs using strptime() and strftime() not working


My original time format in the search is 

eventID: d7d2d438-cc61-4e74-9e9a-3fd8ae96388d
   eventName: StartInstances
   eventSource: ec2.amazonaws.com
   eventType: AwsApiCall

I am not able to convert it using the strptime function 

eval dt_year_epoc = strptime(eventTime, "%Y-%m-%dThh:mm:ssZ")

eval dt_day= strftime(dt_year_epoc, "%d")

Nothing comes up in dt_day




Labels (1)
0 Karma


Thanks. I was able to use strptime and convert it to Epoch and use strftime to the format i wanted. Thank you. 

0 Karma


Is the semantic meaning of of dt_day day of year?  For that, Splunk uses %j. (%d is day of month.  But you cannot have day of month without month.)  Meanwhile, it is much better to simply convert the entire eventTime to epoc.


| makeresults format=csv data="eventTime
``` data emulation above ```
| eval eventTime = strptime(eventTime, "%Y-%m-%dT%H:%M:%SZ")
| eval dt_day = strftime(eventTime, "%j")
| fieldformat eventTime = strftime(eventTime, "%F %T")


For this you get

0302024-01-30 05:00:27

But if you really want day of month without month, you can skip all the conversion and treat eventTime as a simple string.


| makeresults format=csv data="eventTime
``` data emulation above ```
| eval dt_year = mvindex(split(eventTime, "T"), 0)
| eval dt_day = mvindex(split(dt_year, "-"), -1)


This gives you


Hope this helps. 

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...