https://community.splunk.com/t5/Splunk-Search/How-do-I-get-a-substring-from-a-field-after-the-quot-quot/m-p/403653#M116794 <P>You can use rex to get the date substring and then use strptime and strftime to date format. Suppose your string is x="ABCD_20190219_XYZ", then use the below command.</P> <PRE><CODE>rex field=x "_(?&lt;date&gt;\S{8})"| eval time=strptime(date,"%Y%m%d")|eval Date=strftime(time,"%m/%d/%Y") </CODE></PRE> Tue, 29 Sep 2020 23:23:58 GMT Vijeta 2020-09-29T23:23:58Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-a-substring-from-a-field-after-the-quot-quot/m-p/403652#M116793 <P>I have a string as ABCD_20190219_XYZ</P> <P>I need to get 20190219 like 8 characters after first "_" and than convert that substring to a date.</P> <P>Thanks</P> Tue, 29 Sep 2020 23:23:52 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-a-substring-from-a-field-after-the-quot-quot/m-p/403652#M116793 vb1612 2020-09-29T23:23:52Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-a-substring-from-a-field-after-the-quot-quot/m-p/403653#M116794 <P>You can use rex to get the date substring and then use strptime and strftime to date format. Suppose your string is x="ABCD_20190219_XYZ", then use the below command.</P> <PRE><CODE>rex field=x "_(?&lt;date&gt;\S{8})"| eval time=strptime(date,"%Y%m%d")|eval Date=strftime(time,"%m/%d/%Y") </CODE></PRE> Tue, 29 Sep 2020 23:23:58 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-a-substring-from-a-field-after-the-quot-quot/m-p/403653#M116794 Vijeta 2020-09-29T23:23:58Z