topic Re: How do I convert the date format in a custom field? in Getting Data In

How do I convert the date format in a custom field?

egt — Mon, 18 Feb 2019 13:55:43 GMT

Hi,

I'm new here. I want to convert the format from "Thu Jan 31 23:01:13 CET 2019" to "31 Jan 2019" in a custom date field.

How can I do that?

Re: How do I convert the date format in a custom field?

PowerPacked — Mon, 18 Feb 2019 17:59:32 GMT

Try this

| eval new_time = strftime(yourtimefield, "%d %b %Y")

Re: How do I convert the date format in a custom field?

vnravikumar — Mon, 18 Feb 2019 18:12:54 GMT

Hi @egt

Try like

| makeresults 
| eval date="Thu Jan 31 23:01:13 CET 2019" 
| eval epoch = strptime(date,"%a %b %d %H:%M:%S %Z %Y") 
| eval new_date =strftime(epoch,"%d %b %Y")

Re: How do I convert the date format in a custom field?

richgalloway — Mon, 18 Feb 2019 18:19:36 GMT

Try this query:

... | eval time = strftime(strptime(existingTimeField, "%a %b %d %H:%M:%S %Z %Y"), "%d %b %Y") | ...

Re: How do I convert the date format in a custom field?

Vijeta — Mon, 18 Feb 2019 18:20:45 GMT

@egt If your time is in say variable x, then you need to use strptime to convert in time in seconds and then use strftime to convert it to format you need

eval y=strptime(x,"%a %b %d %H:%M:%S %Z %Y")|eval z= strftime(y,"%d %b %Y")

See the example created using makeresults.

|makeresults|eval x= "Thu Jan 31 23:01:13 CET 2019"| eval y=strptime(x,"%a %b %d %H:%M:%S %Z %Y")|eval z= strftime(y,"%d %b %Y")