https://community.splunk.com/t5/Splunk-Search/Time-Format/m-p/69516#M17421 <P>The most robust approach would likely be to strptime your source fields and then to strftime them into whatever you like.</P> <P>See docs on both here: <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions</A></P> Thu, 21 Mar 2013 12:53:00 GMT martin_mueller 2013-03-21T12:53:00Z https://community.splunk.com/t5/Splunk-Search/Time-Format/m-p/69515#M17420 <P>Hi I have a file with fields CloseDateTime and StartDateTime, both the field have a format like "2013-03-08 16:26 PM", I would like to have a separate field which will convert this format into single digit month and would require another field with date of the month.</P> <P>Thanks. </P> Thu, 21 Mar 2013 11:59:06 GMT https://community.splunk.com/t5/Splunk-Search/Time-Format/m-p/69515#M17420 vaibhavbeohar 2013-03-21T11:59:06Z https://community.splunk.com/t5/Splunk-Search/Time-Format/m-p/69516#M17421 <P>The most robust approach would likely be to strptime your source fields and then to strftime them into whatever you like.</P> <P>See docs on both here: <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions</A></P> Thu, 21 Mar 2013 12:53:00 GMT https://community.splunk.com/t5/Splunk-Search/Time-Format/m-p/69516#M17421 martin_mueller 2013-03-21T12:53:00Z