https://community.splunk.com/t5/Splunk-Search/format-output-of-a-string-in-a-particular-format/m-p/367015#M108252 <P>I have a search query that returns numbers like 170503007 and 170504021 as outputs. Need to format them as 2017/05/03 007 and 2017/05/04 021</P> Mon, 08 May 2017 11:05:22 GMT erhksadhwani 2017-05-08T11:05:22Z https://community.splunk.com/t5/Splunk-Search/format-output-of-a-string-in-a-particular-format/m-p/367015#M108252 <P>I have a search query that returns numbers like 170503007 and 170504021 as outputs. Need to format them as 2017/05/03 007 and 2017/05/04 021</P> Mon, 08 May 2017 11:05:22 GMT https://community.splunk.com/t5/Splunk-Search/format-output-of-a-string-in-a-particular-format/m-p/367015#M108252 erhksadhwani 2017-05-08T11:05:22Z https://community.splunk.com/t5/Splunk-Search/format-output-of-a-string-in-a-particular-format/m-p/367016#M108253 <P>Here's one way.</P> <PRE><CODE>... | rex field=foo "(?&lt;yr&gt;\d\d)(?&lt;mon&gt;\d\d)(?&lt;day&gt;\d\d)(?&lt;num&gt;\d{3})" | eval output="20".yr."/".mon."/".day." ".num | ... </CODE></PRE> Mon, 08 May 2017 14:13:37 GMT https://community.splunk.com/t5/Splunk-Search/format-output-of-a-string-in-a-particular-format/m-p/367016#M108253 richgalloway 2017-05-08T14:13:37Z