topic Help to convert date using strftime in Splunk Search

Help to convert date using strftime

Marco_Develops — Fri, 08 Apr 2022 17:35:22 GMT

Currently I have a field holding a Julian date. I am trying to convert it using strftime but i'm having issues.

Date = 2022.091

Current query:

index = * | eval ConvertedDate = strftime(DATE,"%Y.%j")| table ConvertedDate

Ideally I would like to get an output like 04/03/2022

Thank you,

Marco

Re: Help to convert it using strftime

richgalloway — Fri, 08 Apr 2022 17:33:34 GMT

The strftime function converts an epoch timestamp (integer) into a human-readable string. Use the strptime function to convert a datetime string into epoch form.

index = * | eval ConvertedDate = strftime(strptime(DATE,"%Y.%j"), "%m/%d/%Y") | table ConvertedDate

Re: Help to convert it using strftime

Marco_Develops — Fri, 08 Apr 2022 17:33:26 GMT

@richgalloway This worked. Thank you for your time and explanation .

-Marco