topic Converting Time and Date to a Uniform Value in Getting Data In

Converting Time and Date to a Uniform Value

ajdyer2000 — Thu, 08 Aug 2019 20:44:18 GMT

Hi,
I have 3 data sources and all have different time and date formats.

Field1
2019-06-07 17:05:28.513
Field2
Tue, 06 Aug 2019 19:17:24 +0000
Field3
20190718140413.500000-240

I would like to have them all converted to mm/dd/yyyy hour minutes
Field1
06/07/2019 17:05
Field2
08/06/2019 19:47
Field3
07/18/2019 14:04

Thank you
Alan

Re: Converting Time and Date to a Uniform Value

richgalloway — Thu, 08 Aug 2019 20:53:40 GMT

Do you want to do this at index time or search time?
To be clear, are these 3 data sources separate sourcetypes?

Re: Converting Time and Date to a Uniform Value

jawaharas — Fri, 09 Aug 2019 06:45:46 GMT

strptime and strftime are your friends for this problem.

| makeresults
| eval Field1="2019-06-07 17:05:28.513",Field2="Tue, 06 Aug 2019 19:17:24 +0000",Field3="20190718140413.500000-240"
| eval Date1=strftime(strptime(Field1, "%Y-%m-%d %H:%M"),"%m/%d/%Y %H:%M"), Date2=strftime(strptime(Field2, "%a, %d %b %Y %H:%M"),"%m/%d/%Y %H:%M"), Date3=strftime(strptime(Field3,"%Y%m%d%H%M"),"%m/%d/%Y %H:%M")

Reference:
https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Commontimeformatvariables

Can you upvote and accept the answer if it's helped you? Thanks.

Re: Converting Time and Date to a Uniform Value

ajdyer2000 — Fri, 09 Aug 2019 19:57:16 GMT

Awesome !!! Thank you so much!!!!