Convert date field given in dd(numeric)-mmm(text)-yyyy(numeric) into mm/dd/yyyy

vikfnu — Tue, 29 Sep 2020 20:41:07 GMT

Hi
In one of my log reports a date field (not the deafult _time field) has data as 06-Mar-2018 and not as 03/06/2018.
Can anyone suggest a simple approach to do this conversion.
RIght now my thought process is as below:
| makeresults
| eval date = "17-Apr-2018"
|eval splitted=split(date, "-")
|table splitted| eval day = mvindex(splitted, 0)
| eval month_text = mvindex(splitted, 1)
| eval year = mvindex(splitted, 2)
| eval month=case( like(month_text,"Jan") OR like(month_text,"jan"),01, like(month_text,"Feb") OR like(month_text,"feb"),02,like(month_text,"Mar") OR like(month_text,"mar
"),03,like(month_text,"Apr") OR like(month_text,"apr"),04,like(month_text,"May") OR like(month_text,"may"),05,like(month_text,"Jun") OR like(month_text,"jun"),06,
like(month_text,"Jul") OR like(month_text,"jul"),07,like(month_text,"Aug") OR like(month_text,"aug"),08,like(month_text,"Sep") OR like(month_text,"sep"),09,
like(month_text,"Oct") OR like(month_text,"oct"),10,like(month_text,"Nov") OR like(month_text,"nov"),11,like(month_text,"Dec") OR like(month_text,"dec"),12)
|eval date_dt= +toString(month)+"/"+toString(day)+"/"+toString(year)| fields - splitted month_text

Please suggest

Re: Convert date field given in dd(numeric)-mmm(text)-yyyy(numeric) into mm/dd/yyyy

adonio — Tue, 31 Jul 2018 00:39:43 GMT

hello there,

give this a shot:

  | makeresults 
    | eval date = "17-Apr-2018,18-Apr-2018,1-Jan-2018"
    | makemv delim="," date
    | mvexpand date
    | eval to_epoch = strptime(date, "%d-%b-%Y")
    | eval to_desired_format = strftime(to_epoch, "%m/%d/%Y")

hope it helps

topic Re: Convert date field given in dd(numeric)-mmm(text)-yyyy(numeric) into mm/dd/yyyy in Splunk Search

Convert date field given in dd(numeric)-mmm(text)-yyyy(numeric) into mm/dd/yyyy

Re: Convert date field given in dd(numeric)-mmm(text)-yyyy(numeric) into mm/dd/yyyy