Splunk Search

Strptime bug?

ARothman
Path Finder

Has anyone else noticed that strptime does not work in the following situation?

VersionExpiry has a value of 9999-01-01 00:00:00 (or with any year greater than 2999)

eval VersionExpiryEpoch=strptime(VersionExpiry, "%Y-%m-%d %H:%M:%S")

Field "VersionExpiryEpoch" is never created


Does anyone have any workaround ideas to force Splunk in recognizing that existence may, in fact, continue past the year 2999? 😉

The raw data Splunk is receiving is indicating that the version, as of this moment, does not have an expiration date... hence the year 9999. I could, easily, hardcode it in the query that a value of 9999-01-01 00:00:00 means that the version is up to date, but I'd prefer that the function worked correctly.

Tags (1)
0 Karma
1 Solution

dart
Splunk Employee
Splunk Employee

If you just need it to work on that specific far future date, then you could do something like this:

search goes here | eval VersionExpiryEpoch = coalesce(strptime(VersionExpiry, "%Y-%m-%d %H:%M:%S"), 253370786400)

View solution in original post

dart
Splunk Employee
Splunk Employee

If you just need it to work on that specific far future date, then you could do something like this:

search goes here | eval VersionExpiryEpoch = coalesce(strptime(VersionExpiry, "%Y-%m-%d %H:%M:%S"), 253370786400)

ARothman
Path Finder

Seems to have done the trick - thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...