https://community.splunk.com/t5/Splunk-Search/Date-Format/m-p/64415#M15939 <P>If Splunk is not already parsing out this field , you can use something like such:</P> <PRE><CODE>...|rex field=DATE mode=sed "/s/\d{2}:\d{2}:\d{2}//g" </CODE></PRE> Fri, 14 Jun 2013 17:19:06 GMT JSapienza 2013-06-14T17:19:06Z https://community.splunk.com/t5/Splunk-Search/Date-Format/m-p/64414#M15938 <P>I have a field called DATE and it is returning values yyyy-mm-dd HH:MM:SS. I am trying to chop off the hours, min, seconds so I only have yyyy-mm-dd. I have tried to use the convert command but I would rather not have to convert it to epoch time and then convert it back. Is there an easier way to go about this?</P> <P>Thank you in advance</P> Fri, 14 Jun 2013 16:28:47 GMT https://community.splunk.com/t5/Splunk-Search/Date-Format/m-p/64414#M15938 JoeSco27 2013-06-14T16:28:47Z https://community.splunk.com/t5/Splunk-Search/Date-Format/m-p/64415#M15939 <P>If Splunk is not already parsing out this field , you can use something like such:</P> <PRE><CODE>...|rex field=DATE mode=sed "/s/\d{2}:\d{2}:\d{2}//g" </CODE></PRE> Fri, 14 Jun 2013 17:19:06 GMT https://community.splunk.com/t5/Splunk-Search/Date-Format/m-p/64415#M15939 JSapienza 2013-06-14T17:19:06Z https://community.splunk.com/t5/Splunk-Search/Date-Format/m-p/64416#M15940 <P>| eval n=strptime(DATE, "%Y-%m-%d") | convert timeformat="%Y %m %d" ctime(n) AS c_time | chart count by c_time</P> <P>this gave me the count for each day i requested, thank you for the help</P> Mon, 28 Sep 2020 14:05:52 GMT https://community.splunk.com/t5/Splunk-Search/Date-Format/m-p/64416#M15940 JoeSco27 2020-09-28T14:05:52Z https://community.splunk.com/t5/Splunk-Search/Date-Format/m-p/64417#M15941 <P>the most efficient way is to set up TIME_FORMAT in props.conf . That will do the magic at indexing time</P> Tue, 18 Jun 2013 00:21:05 GMT https://community.splunk.com/t5/Splunk-Search/Date-Format/m-p/64417#M15941 asimagu 2013-06-18T00:21:05Z