Splunk Search

calculated fields with strptime

Bastelhoff
Path Finder

Hey there,

I have a _raw where I am extracting a timestamp. But this is in a bad format. So I wanted to have a "calculated field" (via the splunk interface option, not in the conf to which I dont have access). But while other calculated fields seem to work.
basically I have a field called "exTimeString". I want to create a calculated field exTimeStamp What I put into the eval field is:
strptime(exTimeString,"%Y-%m-%dT%H:%M:%S")

Unfortunately it doesn't work. Is it because of the strptime? Ormaybe the % characters cause issues here?

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What is not working (because it looks like you have strptime correct)?

| eval exTimeStamp=strptime(exTimeString,"%Y-%m-%dT%H:%M:%S")

Can you share a sample event and how you have extracted exTimeString from it?

0 Karma

Bastelhoff
Path Finder

Yeah, this eval works when I just convert the extracted field at runtime. But I'd like to have it calculated via "Calculated Fields" (as in Settings->Fields->Calculated Fields)

The original extraction is:
\"summary\"\:\"\{.*?\"timestamp\\\"\:\\\"(?<exTimeString>.*?)\\\".*?\}

This then correctly generates a field exTimeString with content like 
2021-04-23T17:27:21.000Z

If I do a search with
index=myIndex 
|table exTimeString
| eval exTimeStamp=strptime(exTimeString,"%Y-%m-%dT%H:%M:%S")

that also works and returns a valid timstamp (which for example I could use as _time in timecharts)

but if I put 
strptime(exTimeString,"%Y-%m-%dT%H:%M:%S")

into calculated fields instead, it does not work. The calculated field just doesnt show up.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...