topic Changing Time Format in Getting Data In

Changing Time Format

ajdyer2000 — Fri, 29 Dec 2017 21:32:55 GMT

Hi,

I have a search that displays the "UserID Expiration Date" field as "12/6/2019 21:01"

I would like to convert this to a format of the field "2019-12-6" (leaving out the time)

I appreciate all the help. This forum is awesome with awesome people.

Alan

Re: Changing Time Format

micahkemp — Fri, 29 Dec 2017 21:43:57 GMT

Run anywhere search that shows what you want:

| makeresults | eval expiration_original="12/6/2019 21:01" | eval expiration_new=strftime(strptime(expiration_original, "%m/%d/%Y %H:%M"), "%Y-%m-%d")

Re: Changing Time Format

somesoni2 — Fri, 29 Dec 2017 21:45:27 GMT

Try like this

your current search with field "UserID Expiration Date"
| eval "UserID Expiration Date"=strftime(strptime('UserID Expiration Date',"%m/%d/%Y %H:%M"),"%Y-%m-%d")

your current search with field "UserID Expiration Date"
| eval "UserID Expiration Date"=replace('UserID Expiration Date',"^(\d+)\/(\d+\/(\d+)(.+)","\3-\1-\2")

Re: Changing Time Format

mayurr98 — Tue, 02 Jan 2018 05:54:41 GMT

hey, try this.

index=your_base_search | rex field="UserID Expiration Date" "(?P<Date>[^\s]+)"

This will create Date field which will have the values which you want!

Let me know if this helps you!