Splunk Search

Why is strptime and strftime command not working as expected?

monyathomas
New Member

I have two "Survey Type" - 'a' and 'b' and I need to display their count based on the"Survey Complete" data.
Note - The Survey Complete date is in the format MM/DD/YYYY HH:MM format but I need to display it as MM-YYYY format . How do I reframe the below query to get the expected output mentioned above.

index="xyz"
| eval FIELD=strptime("Survey Complete","%m/%d/%Y %H:%M")
| eval DesiredTime=strftime(FIELD,"%Y-%m-%d")
| chart count over "Survey Complete" by "Survey Type"

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You don't say what unexpected output you get, but your query doesn't match your question so that could be it.

Try this:

index="xyz" 
| eval FIELD=strptime("Survey Complete","%m/%d/%Y %H:%M") 
| eval DesiredTime=strftime(FIELD,"%m-%Y")
| chart count over "Survey Complete" by "Survey Type"

You can also use a single eval:

index="xyz" 
| eval DesiredTime=strftime(strptime("Survey Complete","%m/%d/%Y %H:%M"), "%m-%Y)
| chart count over "Survey Complete" by "Survey Type"
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...