data

Siddharthnegi — Thu, 20 Jun 2024 06:47:25 GMT

hello I have a date 2024-06 how can i convert it to 06/2024?
and 2023/Q4 to Q4/2023

Re: data

bowesmana — Thu, 20 Jun 2024 07:00:48 GMT

Is that a field in Splunk that is a string.

You can do this by swapping the characters around - for your first example

| eval date=replace(date, "(\d{4})-(\d{2})", "\2-\1")

and your second

| eval date=replace(date, "(\d{4})\/Q(\d)", "Q\2/\1")

where your data field is called date