topic Re: Field formatting in Splunk Enterprise

Field formatting

arunsoni — Tue, 01 Sep 2020 20:24:31 GMT

Hi All,

I have a field which has improper format. I want to convert into a new field with proper format.

field name: Create

Value : 20190802212241Z

What I am looking is as below

New Field name : NewField

Value : 2019/08/02 21:22:41

Thanks in advance!

to4kawa — Tue, 01 Sep 2020 20:46:10 GMT

|eval NewField=strptime(Create,"%Y%m%d%H%M%S") |fieldformat NewField=strftime(NewField,"%Y/%m/%d %T")

isoutamo — Tue, 01 Sep 2020 21:02:36 GMT

If you want to keep timezone information with date and time then you must add also %Z to the end of formats.
R. Ismo