Well it's a difficult conversion for me, anyway.
Here's the field: dateTime=Fri Jan 18 17:11:55 GMT+00:00 2013
eval dtFormatted=replace(dateTime, ":", "") |
eval dtSeconds=strptime(dtFormatted, "%a %b %d %H%M%S %Z%:z %Y")
In my search results "dtFormatted" is discovered and I've verified it's properly formatted but "dtSeconds" is not discovered.
What am I doing wrong? Why can't I convert this string to seconds?
Try this :
... | rex mode=sed field=dateTime "s/(\+[0-9:]{5})/ \1/"
| eval dtSeconds=strptime(dateTime, "%a %b %d %T %Z %:z %Y")
The problem was that %Z expects a space after the time zone, In your format %Z was being set to GMT+0000 instead of GMT, and %Y was null.
Try this :
... | rex mode=sed field=dateTime "s/(\+[0-9:]{5})/ \1/"
| eval dtSeconds=strptime(dateTime, "%a %b %d %T %Z %:z %Y")
The problem was that %Z expects a space after the time zone, In your format %Z was being set to GMT+0000 instead of GMT, and %Y was null.
I see - I would not have caught that. But your sed/regex works great. Thanks very much!
Yes, thanks. Unfortunately when I copied the search string (on a network that doesn't have access to the Internet) I miscopied it. It's been corrected above.
Shouldn't you have dtFormatted as the 1st argument to strptime ?