Splunk Search

How do I properly convert to UNIX time using strptime with this specific example?

russell120
Communicator

The new myTimefield is blank for some reason -- anyone know why? Consider the below code I'm using:

|makeresults
|eval originalTime = "01/05/19"
|eval myTime = strptime(originalTime, "%m/%d/%Y")
|table originalTime myTime

Oddly enough, it DOES work if I use |eval originalTime = "11:55" with eval myTime = strptime(originalTime, "%H:%M"). Why won't my original query work? Because of this, I'm unable to convert time to UNIX time in my CSVs.

0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Your string format time is wrong. Try this

|makeresults
 |eval originalTime = "01/05/19"
 |eval myTime = strptime(originalTime, "%m/%d/%y")
 |table originalTime myTime

Your upper case %Y is for year with century (i.e. 2019) . You specified without century (i.e. 19) which is %y

View solution in original post

prakash007
Builder

It should be lowercase y in the format...

| makeresults 
| eval originalTime = "01/05/19" 
| eval myTime=strptime(originalTime,"%m/%d/%y")
| table originalTime myTime

With the strptime function, you must specify the time format of the string X so that the function can convert the string time into the correct UNIX time.
http://docs.splunk.com/Documentation/Splunk/7.2.1/SearchReference/DateandTimeFunctions#strptime.28X....

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Your string format time is wrong. Try this

|makeresults
 |eval originalTime = "01/05/19"
 |eval myTime = strptime(originalTime, "%m/%d/%y")
 |table originalTime myTime

Your upper case %Y is for year with century (i.e. 2019) . You specified without century (i.e. 19) which is %y

russell120
Communicator

Ahh you're right, I missed that! Thanks!

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...