https://community.splunk.com/t5/Splunk-Search/convert-date-to-readable-format/m-p/102586#M26514 <P>date is in the format yyyymmdd so output should be 24-01-2013.. but result obtained is something else.. tried changing time date variables</P> Tue, 29 Jan 2013 08:24:11 GMT katesplunk 2013-01-29T08:24:11Z https://community.splunk.com/t5/Splunk-Search/convert-date-to-readable-format/m-p/102584#M26512 <P>Experts, <BR /> Time of the log is appended in my source file name ... I want it to be converted into a human readable format and i prefer assigning the same to a field . lets say new_time.. Hope u can help me...<BR /> Sample file name<BR /> ...... 20130124 ......... file.txt<BR /> ...... 20121229.......... file.txt<BR /> Thanks <BR /> Katrine</P> Tue, 29 Jan 2013 07:27:46 GMT https://community.splunk.com/t5/Splunk-Search/convert-date-to-readable-format/m-p/102584#M26512 katesplunk 2013-01-29T07:27:46Z https://community.splunk.com/t5/Splunk-Search/convert-date-to-readable-format/m-p/102585#M26513 <P>first, extract the date from the source.</P> <P><CODE>source=*mysource* | rex field=source "(?&lt;_date_&gt;\d{8})" | table _date_</CODE></P> <P>see <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex</A></P> <P>second convert the date using your format of choice .<BR /> <CODE>mysearch | convert TIMEFORMAT="%Y-%m-%d" ctime(_date_) AS date</CODE></P> <P>see <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Convert">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Convert</A></P> Tue, 29 Jan 2013 07:37:31 GMT https://community.splunk.com/t5/Splunk-Search/convert-date-to-readable-format/m-p/102585#M26513 yannK 2013-01-29T07:37:31Z https://community.splunk.com/t5/Splunk-Search/convert-date-to-readable-format/m-p/102586#M26514 <P>date is in the format yyyymmdd so output should be 24-01-2013.. but result obtained is something else.. tried changing time date variables</P> Tue, 29 Jan 2013 08:24:11 GMT https://community.splunk.com/t5/Splunk-Search/convert-date-to-readable-format/m-p/102586#M26514 katesplunk 2013-01-29T08:24:11Z https://community.splunk.com/t5/Splunk-Search/convert-date-to-readable-format/m-p/102587#M26515 <P>What did you try exactly?</P> Tue, 29 Jan 2013 08:45:26 GMT https://community.splunk.com/t5/Splunk-Search/convert-date-to-readable-format/m-p/102587#M26515 Drainy 2013-01-29T08:45:26Z https://community.splunk.com/t5/Splunk-Search/convert-date-to-readable-format/m-p/102588#M26516 <P>have the same query, but i dont want it to be in readable format as i am using this time for sorting my field entries..<BR /> How to convert the date in the above format to epoch time?<BR /> 201303140216<BR /> yyyymmddHHMM<BR /> here hour and minute is in 12 hours clock, so the time may be 02:16PM<BR /> tried converting it using <BR /> time=strptime(mytime,"%Y%m%d%I%M") <BR /> not seems to be working properly...<BR /> please help</P> Thu, 14 Mar 2013 10:00:32 GMT https://community.splunk.com/t5/Splunk-Search/convert-date-to-readable-format/m-p/102588#M26516 smolcj 2013-03-14T10:00:32Z