Hi, I don't understand why my datetime extracted can't convert when same format has no issue
host="gm*w8*" OR host="gm*w12*" sourcetype="WinEventLog:System" EventCode=6008
|rex field=Message "at (?.[M])"
|rex field=Message "on (?.)/(?.)/(?[^ ])"
|eval IDate=IMon+"-"+IDay+"-"+IYear
|eval IDateTime= IDate+" "+ITime
|eval IDateTime_epoch = strptime(IDateTime, "%m-%d-%Y %l:%M:%S %p")
|eval DateTime = strftime(IDateTime_epoch, "%Y-%m-%d %H:%M:%S")
| eval my_time = "2-14-2017 1:06:59 PM"
| eval my_time_epoch = strptime(my_time, "%m-%d-%Y %l:%M:%S %p")
| eval mytime = strftime(my_time_epoch, "%Y-%m-%d %H:%M:%S")
|table IDateTime,IDateTime_epoch,DateTime,my_time,my_time_epoch,mytime
... View more