Splunk Search

Why is strptime() eval not working?

dtibi
Explorer

I'm trying to evaluate the date string to a time format sing the strptime()

the format I have is:  
Tue_Oct_25_03:57:49_IDT_2022

the strptime function looks like: 
strptime(date,"%a_%b_%d_%H:%M:%S_%Z_%Y")


Running the query:
index="some_index" source="some_source" | head 20 | eval d=strptime(date,"%a_%b_%d_%H:%M:%S_%Z_%Y") | table d date

shows me a table with empty d values and date is showing as expected.
What am I doing wrong here?

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

This looks like a bug - IDT doesn't appear to be supported by strptime() - try replacing it with the equivalent

| eval d=strptime(replace(date,"IDT","+0300"),"%a_%b_%d_%H:%M:%S_%z_%Y")

Note the change to lowercase z in the timeformat

View solution in original post

dtibi
Explorer

You mean the copy from screen to code sample like this ? (see below) 
Do know if there Is a way to debug this further?
maybe because the field name is date it has some internal conflict or some other black magic causing this not to work? 😜

index="index_name" source="source_name" | head 20 | eval d=strptime(date,"%a_%b_%d_%H:%M:%S_%Z_%Y") | table d date


d	date
 	Tue_Oct_25_03:57:49_IDT_2022
 	Tue_Oct_25_03:57:48_IDT_2022
 	Tue_Oct_25_03:57:48_IDT_2022
 	Tue_Oct_25_03:57:47_IDT_2022

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @dtibi,

yes this is the way to share code or samples that can be reused.

Could you share the sample logs not the results of the search?

Anyway, probably the solution is the one indicated by @ITWhisperer .

Ciao.

Giuseppe

ITWhisperer
SplunkTrust
SplunkTrust

As I said, IDT doesn't appear to be supported by Splunk's strptime() function.

ITWhisperer
SplunkTrust
SplunkTrust

This looks like a bug - IDT doesn't appear to be supported by strptime() - try replacing it with the equivalent

| eval d=strptime(replace(date,"IDT","+0300"),"%a_%b_%d_%H:%M:%S_%z_%Y")

Note the change to lowercase z in the timeformat

dtibi
Explorer

Thank you!!!! @ITWhisperer 

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @dtibi ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

dtibi
Explorer

Hi @gcusello 
Thanks for the reply.
I'm pretty sure.
This issue waisted a lot of my time. not sure how to handle. 
Would very much appreciate any help.

Screenshot 2023-05-17 131725.jpg

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @dtibi ,

could you share some sample of your logs?

please use the Insert/Edit code sample button and not a screenshot!

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @dtibi,

the strptime funtion is correct, are you sure about the date values?

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...