Splunk Search

strptime and mktime not generating any values

thyrfa
New Member

I have a CSV with a date field that I want to convert to a timefield so that I can timechart it. When I run

 ...| rename "field I want" as time | eval time = case(substr(time, 1, 2) LIKE "%/", "0"+time, 1=1, time) |  convert timeformat="%m/%e/%Y  %I:%M %p" mktime(time) |

time ends up being always null. When I do

...| rename "field I want" as time | eval time = case(substr(time, 1, 2) LIKE "%/", "0"+time, 1=1, time) | eval ntime=strptime(time, "%m/%e/%Y  %I:%M %p") |

ntime doesn't even get created as a field. I'm 100% sure that the formatting is correct (though theres always a chance for errors) and I've tried everything I can think of. Why does neither function evaluate? An example of one of the strings I'm trying to convert is "1/1/2013 12:00 AM".

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

I don't think you need that case statement at all. Following direct conversion works (run anywhere sample)

| gentimes start=-1 | eval time="1/1/2013 12:00 AM" | table time| eval ntime=strptime(time,"%m/%d/%Y %H:%M %p")

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

I don't think you need that case statement at all. Following direct conversion works (run anywhere sample)

| gentimes start=-1 | eval time="1/1/2013 12:00 AM" | table time| eval ntime=strptime(time,"%m/%d/%Y %H:%M %p")
0 Karma

thyrfa
New Member

Woah that worked! The issue was me putting the table after evaluating ntime. Why does that matter?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

It won't. Probably the timeformat you used was the issue, along with additional formatting you were trying.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...