Why is strptime not returning results for a date field in my data?

[ErikaE]

I have a time in the following format: 2015-08-11 16:31:25.973 in a field called "Last Modified On". The data comes from a log with several columns containing date time information.

What I'd like is to get a field at search-time that has just the date from the "Last Modified On" field, so I can group other fields by that date at search-time.

Here is my search:

host=* | eval test=strptime('Last Modified On',"%Y%m%d") | table test "Last Modified On"

The output is a table with blanks for all the test field values, and the date time in the Last Modified On field.

I have read other questions, but can't seem to find a similar example where strptime returns a blank for a string date. Is there a way to confirm that "Last Modified On" contains string data?

[maciep · Accepted solution]

I think you need to put the dashes in your format string, since they're in your last modified on field

eval test=strptime('Last Modified On',"%Y-%m-%d")

[ErikaE]

Awesome. The answer was in epoch time but I was able to convert it with strftime.

LastModDate=strftime(strptime('Last Modified On',"%Y-%m-%d"),"%m %d %Y")