5
responses

parsedate is returning undefined for the string directly from the documentation: "2017-Mar-23 06:38:30.143"

If I change the "Mar" to "03", making "2017-03-23 06:38:30.143", it works, returning "2017-02-23 06:38:20"

Any insights as to why the sample string from the documentation isn't working appreciated!

AskedMarch 3, 2019 - 7:47pm

Comments (2)

  • nimaimalle's picture

    Found out that too many digits after the decimal point on the seconds field can cause parsedate not to work.

    $EventTime = parsedate("2019-03-07T18:46:36.508077-0600");
    log_info($EventTime);
    $EventTime = parsedate("2019-03-07T18:46:36.508077100-0600");
    log_info($EventTime);
    

    The second parsedate returns null or undefined.

Answer (1)

directly from the documentation

Can you be more specific?

Maybe I missed something but I do not see the above format in the list under parsedate().

Comments (2)

  • nimaimalle's picture

    Hm~ You're right! I could have sworn I found that, and copied it from the docs. My apologies. ... In any case, I ended up parsing the date into pieces and putting them back together in the following way:

    Given "04-Mar-2019 14:21:05.619"

    if $raw_event =~ /^([0-9]{2})-([A-Z][a-z]{2})-([12][0-9]{3}) ([0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3}):([A-Za-z]+):([A-Za-z]:[^:]+):([0-9]+):([^:]+):(.*)/s
    {
      if $2 == 'Jan' set_var('month', '01');
      else if $2 == 'Feb' set_var('month', '02');
      else if $2 == 'Mar' set_var('month', '03');
      else if $2 == 'Apr' set_var('month', '04');
      else if $2 == 'May' set_var('month', '05');
      else if $2 == 'Jun' set_var('month', '06');
      else if $2 == 'Jul' set_var('month', '07');
      else if $2 == 'Aug' set_var('month', '08');
      else if $2 == 'Sep' set_var('month', '09');
      else if $2 == 'Oct' set_var('month', '10');
      else if $2 == 'Nov' set_var('month', '11');
      else if $2 == 'Dec' set_var('month', '12');
      $timestamp = $3 + '-' + get_var('month') + '-' + $1 + ' ' + $4;
    ...
    

    Would love to know if there's a better way.