Splunk Search

Issue with strptime and strftime

deepak312
Explorer

I have a time input like below,

Mon Jul 13 09:30:00 PDT 2015

| eval human_readable_time= strftime(strptime(my_time, "%a %b %d %H:%M:%S %Z %Y"), "%m/%d/%y")

This doesn't return me anything. Not sure what is wrong. Any idea?
Second approach, I have tried is,

| eval human_readable_time= strftime(my_time, "%+")

marina_rovira
Contributor

HI there!

Have any of you two find a solution do this? I'm trying to get a time period for a call useing this:
eval final=(strptime(EndTime, "%a %b %d %H:%M:%S %Z%z %Y") | eval start=strptime(StartTime, "%a %b %d %H:%M:%S %Z%z %Y")

And then the rest between final-start, but I'm getting both fields empty. Any idea?

Thank you!

0 Karma

gcusello
SplunkTrust
SplunkTrust

I tried your transformation and the first one correctly works (the second one no).
could you share a log example?
I tried with the following search

index=* | head 1 | eval my_time="Mon Jul 13 09:30:00 PDT 2015" | eval human_readable_time=strftime(strptime(my_time,"%a %b %d %H:%M:%S %Z %Y"),"%m/%d/%y") | table _time human_readable_time

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...