topic Re: How to turn string into date format in Getting Data In

How to turn string into date format?

vishalduttauk — Thu, 29 Sep 2022 14:44:02 GMT

I have a string of data and i've created regex to break down that set into different fields. There are date values within it (start_date and end_date) but format is ddmmyyy i.e. 2901012001.How can i convert it into DD-MM-YYYY so Splunk recognises it as a date or can be shown in that date format?

Ideally i'd like that to be down on ingestion. I have a props.conf and transforms.conf file for the app this sits in

Re: How to turn string into date format

gcusello — Thu, 29 Sep 2022 08:27:38 GMT

Hi @vishalduttauk,

sorry, it isn't clear what's your fields format: you said "ddmmyyy" but the sample you used has 10 digits (2901012001), what's the correct one?

Anyway, you have to convert it in epochtime and then in the date format you like, something like this:

| your_date=strftime(strptime(yourfield,"%d%m%Y"),"%d-%m-%Y")

Ciao.

Giuseppe

Re: How to turn string into date format

vishalduttauk — Thu, 29 Sep 2022 09:14:21 GMT

Hi @gcusello

Thanks for your reply and sorry i pasted in the wrong information as an example but you are correct my message didn't have the correct format. it should have been 01021999.

Kind Regards,

Vishal

Re: How to turn string into date format

gcusello — Thu, 29 Sep 2022 09:20:30 GMT

Hi @vishalduttauk,

this means the the original format is "ddmmyyyy" (with 4 digits for the year), can you confirm?

in this case you can use my eval statement:

| your_date=strftime(strptime(yourfield,"%d%m%Y"),"%d-%m-%Y")

Ciao.

giuseppe

Re: How to turn string into date format

vishalduttauk — Thu, 29 Sep 2022 09:27:17 GMT

Thanks @gcusello

Its the first time i am using eval so it worked after i put in | eval

👍