Splunk Search

strptime conversion difficulty from a string

mdurdel
New Member

Hello,

I am having difficulty getting the strptime function to properly convert my date string into a usable and accurate time stamp. Here is an example of the string and the strptime function I have tried. Can you help with the proper conversion please?

string=05-NOV-19 10.53.49.287000 AM AMERICA/CHICAGO

This did not work: | eval first_res_time = strptime(previous_resolution_time, "%d/%B/%y %H/%M/%S/%N")

Thank you,

-MD

0 Karma
1 Solution

mayurr98
Super Champion

Try this:

| makeresults 
| eval string="05-NOV-19 10.53.49.287000 AM AMERICA/CHICAGO" 
| eval first_res_time=strptime(string, "%d-%b-%y %I.%M.%S.%6N %p")

For timezone, you may need to make changes in the props.conf:

TZ=America/Chicago

Refer https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
Splunk docs https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/Applytimezoneoffsetstotimestamps

View solution in original post

0 Karma

mayurr98
Super Champion

Try this:

| makeresults 
| eval string="05-NOV-19 10.53.49.287000 AM AMERICA/CHICAGO" 
| eval first_res_time=strptime(string, "%d-%b-%y %I.%M.%S.%6N %p")

For timezone, you may need to make changes in the props.conf:

TZ=America/Chicago

Refer https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
Splunk docs https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/Applytimezoneoffsetstotimestamps

0 Karma

mdurdel
New Member

Thank you @mayurr98

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That strptime format string doesn't match the data. Try %-%b-%y %h.%M.%S.%6N %p %Z. I'm not sure Splunk will recognize "AMERICA/CHICAGO" as time zone identifier, though.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...