Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- strptime and mktime not generating any values
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a CSV with a date field that I want to convert to a timefield so that I can timechart it. When I run
...| rename "field I want" as time | eval time = case(substr(time, 1, 2) LIKE "%/", "0"+time, 1=1, time) | convert timeformat="%m/%e/%Y %I:%M %p" mktime(time) |
time ends up being always null. When I do
...| rename "field I want" as time | eval time = case(substr(time, 1, 2) LIKE "%/", "0"+time, 1=1, time) | eval ntime=strptime(time, "%m/%e/%Y %I:%M %p") |
ntime doesn't even get created as a field. I'm 100% sure that the formatting is correct (though theres always a chance for errors) and I've tried everything I can think of. Why does neither function evaluate? An example of one of the strings I'm trying to convert is "1/1/2013 12:00 AM".
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't think you need that case statement at all. Following direct conversion works (run anywhere sample)
| gentimes start=-1 | eval time="1/1/2013 12:00 AM" | table time| eval ntime=strptime(time,"%m/%d/%Y %H:%M %p")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't think you need that case statement at all. Following direct conversion works (run anywhere sample)
| gentimes start=-1 | eval time="1/1/2013 12:00 AM" | table time| eval ntime=strptime(time,"%m/%d/%Y %H:%M %p")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Woah that worked! The issue was me putting the table after evaluating ntime. Why does that matter?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It won't. Probably the timeformat you used was the issue, along with additional formatting you were trying.
Data Management Digest – December 2025
Index This | What is broken 80% of the time by February?
Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...
