topic How to change the date format from 'yyyy-mm-dd' to 'mm-dd-yyyy' on the saved search? in Splunk Search

How to change the date format from 'yyyy-mm-dd' to 'mm-dd-yyyy' on the saved search?

Neel88 — Wed, 01 Feb 2023 23:55:45 GMT

I am working on the saved search not index/lookup.

I tried this code -

| eval date=strftime(strptime(<fieldname>,"%Y-%m-%d %H:%M:%S"), "%m-%d-%Y %H:%M:%S")

but getting the blank data. Pls help

Re: How to change the date format from 'yyyy-mm-dd' to 'mm-dd-yyyy' on the saved search?

bowesmana — Thu, 02 Feb 2023 00:12:23 GMT

There is nothing wrong with the eval statement, so it means that your field (which I assume is not the "<fieldname>" but the name of a field) is not in that format.

| makeresults | eval x="2023-02-02 04:02:01" | eval date=strftime(strptime(x,"%Y-%m-%d %H:%M:%S"), "%m-%d-%Y %H:%M:%S")

Re: How to change the date format from 'yyyy-mm-dd' to 'mm-dd-yyyy' on the saved search?

Neel88 — Thu, 02 Feb 2023 00:36:32 GMT

| loadjob savedsearch="nobody:splunk_fcr_evo:last_31_days_monitoring_data"
| eval New_date=strftime(strptime(Date,"%Y-%m-%d %H:%M:%S"), "%m-%d-%Y %H:%M:%S")
| fields Date, adt, FLOW, NB1, New_date

Above gives blank results in the New_date column

Re: How to change the date format from 'yyyy-mm-dd' to 'mm-dd-yyyy' on the saved search?

bowesmana — Thu, 02 Feb 2023 04:33:44 GMT

Please show the value of the Date field after the loadjob

Re: How to change the date format from 'yyyy-mm-dd' to 'mm-dd-yyyy' on the saved search?

Neel88 — Thu, 02 Feb 2023 08:29:55 GMT

Date

2022-06-04

2022-06-05

Re: How to change the date format from 'yyyy-mm-dd' to 'mm-dd-yyyy' on the saved search?

isoutamo — Thu, 02 Feb 2023 16:54:40 GMT

your Date is not in the same format as you are using on strptime. You haven’t have hours, minutes and seconds on it. For that reason this didn’t work. Just drop those away from format or use field which contains also those.

r. Ismo