Splunk Search

Problem with strptime() when date is earlier than 1970

manus
Communicator

|eval DateMeasured="1900-01-01"

|eval DateMeasured=strftime(strptime(DateMeasured,"%Y-%m-%d"),"%d/%m/%Y")

Returns nothing. And I think it's because the date is before 1rst jan 1970.

Does somebody know how to make this work?

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this workaround.

|eval DateMeasured="1900-01-01" | eval DateMeasured=replace(DateMeasured,"^(\d{4})-(\d{1,2})-(\d{1,2})", "\3/\2/\1") 

View solution in original post

somesoni2
Revered Legend

Try this workaround.

|eval DateMeasured="1900-01-01" | eval DateMeasured=replace(DateMeasured,"^(\d{4})-(\d{1,2})-(\d{1,2})", "\3/\2/\1") 

manus
Communicator

Yes, that works!

0 Karma

manus
Communicator

As my question implied, I wanted to re-format it.
Thank you very much for the quick answer.

0 Karma

somesoni2
Revered Legend

Splunk only support date with epoch value greater than 0 (which is 01 Jan 1970 00:00:00 UTC). What do you intend to do with dates older than 1970?

Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...