topic how to change the date format in splunk? in Getting Data In

how to change the date format in splunk?

shankarananthth — Tue, 31 May 2016 08:49:28 GMT

I have the date format like 2016-03-09 11:43:40.870 ( "%Y-%m-%d %H:%M:%S)

But i want to change the above date format like 03-09-2016 11:43:40.870 (%m-%d-%Y %H:%M:%S)

Thanks in advance

richgalloway — Tue, 31 May 2016 13:00:57 GMT

Try this:

... | eval date=strftime(strptime(date,"%Y-%m-%d %H:%M:%S"), "%m-%d-%Y %H:%M:%S") | ...

woodcock — Tue, 31 May 2016 13:01:35 GMT

At search time you can do this:

| eval newDate=strftime(strptime(oldDate, "%Y-%m-%d %H:%M:%S"), "%m-%d-%Y %H:%M:%S")

or like this:

| rex mode=sed field=oldDate "s/(\d{4})-(\d+-\d+) /\2-\1 /"

At index time, like this:

SEDCMD-englishDateToUSA "s/(\d{4})-(\d+-\d+) /\2-\1 /"