Splunk Search

mktime/strptime error (not working as documented)

npt05001
Engager

I have a field in some events that contains a time as a string. The times are in the format "2010-07-15-13", which the fields representing "%Y-%m-%d-%H" (year,month,day,24-hour). I'm trying to convert this string to a time, and I've tried several functions-

| eval _time=strptime(hour,"%Y-%m-%d-%H")

| convert timeformat="%Y-%m-%d-%H" mktime(hour) as _time

However, neither of these functions gives me the correct results. I do get a result- I read that if the provided format string doesn't match the string to parse, you get no result- but the result is wrong, having chopped off the hour portion of the string. Example-

2010-07-08-10 -> 7/8/10 12:00:00.000 AM

2010-07-08-11 -> 7/8/10 12:00:00.000 AM

This is not the result I'm looking for as I need the hour data to be in my end result.

Does anyone know why these functions are not working as expected?

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

How about just appending the minutes so it is parseable as a time stamp?

| eval _time=strptime(_time+"-00","%Y-%m-%d-%H-%M")

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

How about just appending the minutes so it is parseable as a time stamp?

| eval _time=strptime(_time+"-00","%Y-%m-%d-%H-%M")

npt05001
Engager

That works! Thanks a lot. I wonder if I should submit a bug report, because I shouldn't really have to do this, and it still doesn't work with the convert command, but at least I have my desired results.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...