converting to an epoch date format using strptime

[pc1234]

I’m trying to extract the date and time from the Winevent log when an unexpected shutdown has occurred(EventCode=6008)
The message in the event is below:
The previous system shutdown at 7:53:08 AM on 3/2/2016 was unexpected.

I created two extracted fields to capture the shutdown date and time respectively: shutdown date(3/2/2016) and shutdown time(7:53:08). The code below joins the two fields together and inputs them into the strptime function.
This function however doesn’t return a value. However, if I pass a hardcoded value to strptime(“3/2/2016 7:53:08 AM”) it returns an epoch value. Can someone help? thanks.

index=wineventlog EventCode=6008
| Eval combo = shutdown_date + “ “ + shutdown_time | eval otime = strptime(combo, “%m%d%Y%I:M:%S %p”)
Table otime

[somesoni2]

First, there seems to be a typo in the time format for strftime, instead of %M, its just M. Check if that is correctly used in your search.
Second, check if the field extraction for shutdown_date and shutdown_time is not adding additional spaces in the values, though they won't be visible in the table visualization in Splunk but will mess up your time conversion. If possible share the regular expression used for the extraction.

[pc1234]

you were correct about the field extraction. The problem was hidden characters or spaces. I changed the regex and the date fields now convert without issue. thanks again for the help.

[somesoni2]

You're combining the fields by adding a space in between but your time format in strptime command doesn't include space. Add a space after %Y, and it should work fine.

[pc1234]

I added a space after %Y and still do not get results(with a table otime statement. ). With a table otime combo statement the combo displays correctly "3/2/2016 7:53:08 AM" but no values are displayed for otime.

[DMohn]

Try the solution from my answer below - this should work!

[ddrillic]

Based on what you said, I tried the following -
| eval timestamp=strptime("3/2/2016 7:53:08 AM", "%m%d%Y%I:M:%S %p") and nothing comes back.

"3/2/2016 7:53:08 AM" doesn't seem to match the "%m%d%Y%I:M:%S %p" part.

[DMohn]

Mind the capitalization and the spaces here ....

... base_search ... | eval combo = shutdown_date + " " + shutdown_time | eval otime = strptime(combo, "%m/%d/%Y %I:%M:%S %p") | table otime

This should do it. Maybe try a table combo to see what the field combo actually contains.

[ddrillic]

Right - | eval timestamp=strptime("3/2/2016 7:53:08 AM", "%m/%d/%Y %I:%M:%S %p") works.