Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Help: Need a Brutal But Clever Date and Time Parsing

$
0
0
I'm working with a date and time field that's causing a headache. Need to parse it to epoch but using `strptime(MyInconsistentDateTimeField, "%d/%m/%Y %l:%M:%S")` would only work with some of the values in this field. Say I have a date of "January 2, 2019 9:10:10 a.m." below are the possible formats of my field. MyInconsistentDateTimeField 02/01/2019 09:10:10 2/01/2019 09:10:10 02/1/2019 09:10:10 2/1/2019 09:10:10 02/01/2019 09:10 2/01/2019 09:10 02/1/2019 09:10 2/1/2019 09:10 02/01/2019 9:10:10 2/01/2019 9:10:10 02/1/2019 9:10:10 2/1/2019 9:10:10 02/01/2019 9:10 2/01/2019 9:10 02/1/2019 9:10 2/1/2019 9:10 As you can see, only the first item can be parsed using `| eval parsedDate = strptime(MyInconsistentDateTimeField, "%d/%m/%y %H:%M:%S")` How do I brute force parsing this one? I'm thinking of separating every element of the date using regex, treat them, and then concatenate later on before parsing (e.g. day, month, year, hour, minute would be separate fields). But I don't know how to do it. Thanks in advance! p.s. It's okay to ignore the 10 seconds in this date.

Viewing all articles
Browse latest Browse all 47296

Trending Articles