https://community.splunk.com/t5/Splunk-Search/How-to-extract-date-YYYYMMDD-from-time/m-p/90668#M23289 <PRE><CODE>... | eval mytime=strftime(_time, "%Y%m%d") | table mytime </CODE></PRE> Wed, 10 Jul 2013 09:14:01 GMT Damien_Dallimor 2013-07-10T09:14:01Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-date-YYYYMMDD-from-time/m-p/90667#M23288 <P>How to extract date YYYYMMDD from _time?</P> Wed, 10 Jul 2013 09:06:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-date-YYYYMMDD-from-time/m-p/90667#M23288 royimad 2013-07-10T09:06:08Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-date-YYYYMMDD-from-time/m-p/90668#M23289 <PRE><CODE>... | eval mytime=strftime(_time, "%Y%m%d") | table mytime </CODE></PRE> Wed, 10 Jul 2013 09:14:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-date-YYYYMMDD-from-time/m-p/90668#M23289 Damien_Dallimor 2013-07-10T09:14:01Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-date-YYYYMMDD-from-time/m-p/90669#M23290 <P>How do i get this treated as date again?<BR /> I was using the above eval to get just the date out (ignoring the time) ... but i see that the string extracted is treated as a number when i graph it.</P> <P>How do i get it converted back to date?</P> <P>eg: i have events with different timestamp and the same date. I want to group them based on the date by ignoring the timestamp on it.</P> Fri, 01 Nov 2013 14:48:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-date-YYYYMMDD-from-time/m-p/90669#M23290 nandipatisunil 2013-11-01T14:48:23Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-date-YYYYMMDD-from-time/m-p/90670#M23291 <P>with <CODE>strptime</CODE>;</P> <PRE><CODE>...| eval my_new_time = strptime(mytime, "%Y%m%d") </CODE></PRE> <P>/k</P> Fri, 01 Nov 2013 15:15:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-date-YYYYMMDD-from-time/m-p/90670#M23291 kristian_kolb 2013-11-01T15:15:40Z