Hey guys,
So I've used strptime before but for some reason this isn't working properly. I have a column with different types of data like below:
Column |Value ------------------ 02/2016 | 100 03/2016 | 200 04/2016 | 150 05/2016 | 450 high | 12 medium | 30 low | 34
I have a column that separates the dates from the rest. so with that me search s simple:
index="servers" filter="dates" | eval myDate = strptime(Column, "%m/%Y")|table myDate
"filter" would be the field thats used separate the date from other data. This search gives me nothing.
What would the problem and how would i get it to work?
Thanks in advanced!
The issue here is that strptime need both date and month to parse a string formated date to epoch. Year is optional. Your data doesn't have date part, hence strptime fails.
Option: add date part explicitly (when using month you anyways refer to first date of the month).
index="servers" filter="dates" | eval myDate = strptime("01/".Columns, "%d/%m/%Y")|table myDate
The issue here is that strptime need both date and month to parse a string formated date to epoch. Year is optional. Your data doesn't have date part, hence strptime fails.
Option: add date part explicitly (when using month you anyways refer to first date of the month).
index="servers" filter="dates" | eval myDate = strptime("01/".Columns, "%d/%m/%Y")|table myDate
+1, Somesoni Sir.
One question -
///Option: add date part explicitly (when using month you anyways refer to first date of the month).///
why refer to first date, when using month?!?
Take the reference of the timechart with span=1mon. All the _time value will be set to "01/Month/Year 00:00:00 AM". While bucketing Splunk assigns lower value to the bucket, for month it'll be first day.
Worked! Thank you for the great explanation!
The screen shot has a "Column" field, but the SPL has "Columns". Parsing a column that doesn't exist will yield nothing.
Just an error when asking question. Fixed but the issue is still the same. Sorry about that