I have two date formats coming into my index (01/11/2018) and (01/11/18). I wrote:
| eval LastSeen_epoch = strptime('LastSeen', "%m/%d/%Y %H:%M"),strptime('LastSeen', "%m/%d/%y %H:%M")
However, this does not work to convert both types that are coming in. (Y and y) are the differences.
Any ideas?
Try wrapping your strptime calls in coalsece like this:
eval LastSeen_epoch = coalesce(strptime('LastSeen', "%m/%d/%Y %H:%M"),strptime('LastSeen', "%m/%d/%y %H:%M"))
This should return the epoch time for the first format which can be successfully used to parse LastSeen.
Check the length of your "Last_date" field using len() function, if length is 8 then use %y format else if length is 10 use %Y format. Let me know if you need help forming the query.