Splunk Search

Issue with strptime

efelder0
Communicator

I am trying to reformat a date field in Splunk. I have a field called "last_updated_date" and its value is 2012-04-03.

I am using the strptime command to reformat the field to the following: 04/03/12.
Here is my syntax:
eval last_updated_date=strftime(strptime(last_updated_date,"%Y-%b-%D"),"%M/%D/%Y")

However, it returns blank values in my output.

Thoughts?

Tags (1)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

There's (at least) two ways of dealing with this. If you want to change the raw data within the event as it is being indexed then as cvajs suggested, SEDCMD is the route to take. It would look something like this:

[mysourcetype]
SEDCMD-date=s/\d{2}(\d{2})-(\d{2})-(\d{2})/\2\/\3\/\1/

(Assuming I got my sed syntax 100% correct)

Your strftime + strptime approach should work as well. It obviously does not change the data in the index, but it should update the field correctly. But, I think you have your format strings wrong:

... | eval last_updated_date=strftime(strptime(last_updated_date,"%Y-%m-%d"),"%m/%d/%y")

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

There's (at least) two ways of dealing with this. If you want to change the raw data within the event as it is being indexed then as cvajs suggested, SEDCMD is the route to take. It would look something like this:

[mysourcetype]
SEDCMD-date=s/\d{2}(\d{2})-(\d{2})-(\d{2})/\2\/\3\/\1/

(Assuming I got my sed syntax 100% correct)

Your strftime + strptime approach should work as well. It obviously does not change the data in the index, but it should update the field correctly. But, I think you have your format strings wrong:

... | eval last_updated_date=strftime(strptime(last_updated_date,"%Y-%m-%d"),"%m/%d/%y")

cvajs
Contributor

i think SEDCMD is a better route

0 Karma

efelder0
Communicator

I am looking to reformat the date to MM/DD/YYYY. Should this be done in props instead?

0 Karma

efelder0
Communicator

so, maybe strptime would not be useful in this scenario?

0 Karma

cvajs
Contributor

you wrote "strftime"
is that the right command?
strftime takes (X) as epoch time and converts it to format Y

you dont have epoch time anywhere in your syntax. epoch is # of sec since jan 1 1970 00:00:00 UTC

http://docs.splunk.com/Documentation/Splunk/4.3.1/SearchReference/CommonEvalFunctions

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...