topic Re: How can I change the date format of search results? in Splunk Search

How can I change the date format of search results?

cmartell — Fri, 06 Feb 2015 17:38:27 GMT

All of my devices send logs to Splunk with date format set at yyyy-mm-dd, as they should, and Splunk reads them fine and displays the correct dates in the search results but in the wrong format. The dates are displayed in the default US format of mm-dd-yyyy. How can I fix this so search results show yyyy-mm-dd?

Re: How can I change the date format of search results?

ppablo — Fri, 06 Feb 2015 18:05:44 GMT

Hi @cmartell

Have you checked out the documentation on configuring proper timestamp recognition at index-time?
http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/HowSplunkextractstimestamps
http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Configuretimestamprecognition

Re: How can I change the date format of search results?

ppablo — Fri, 06 Feb 2015 18:08:04 GMT

Otherwise, you can also do this at search time using eval and its function strptime, but I'm not sure you'd want to do that every time you run a search.
http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/CommonEvalFunctions

Re: How can I change the date format of search results?

cmartell — Fri, 06 Feb 2015 18:27:54 GMT

Hi Pablo and thanks for your response.

Splunk isn't having any trouble recognizing time stamps. It reads them fine and displays the correct dates in the search results. The problem is that it displays the dates as mm-dd-yyyy instead of yyyy-mm-dd

Re: How can I change the date format of search results?

cmartell — Fri, 06 Feb 2015 18:41:02 GMT

Small correction is that the dates are displaying as mm-dd-yy not mm-dd-yyyy

Re: How can I change the date format of search results?

ppablo — Fri, 06 Feb 2015 18:58:24 GMT

are the dates appearing in the raw event as mm-dd-yy or just the table in your search results? This section of the documentation might give you some hints on where to look where the issue might be
http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Configuretimestamprecognition#Configure_how_timestamps_appear_in_search_results

Re: How can I change the date format of search results?

cmartell — Fri, 06 Feb 2015 19:16:39 GMT

In the Time column I am seeing mm-dd-yy and would like to see yyyy-mm-dd. In the Event column I see mmm dd which is fine.

I have created a props.conf file in the local folder with this text and it didn't help:
[splunkd]
TIME_FORMAT = %Y-%m-%d %H:%M:%S

Re: How can I change the date format of search results?

jaqb — Thu, 07 Apr 2016 13:20:20 GMT

Any successes ?

I also would like have natural (yyyy-mm-dd) date in search results.

Re: How can I change the date format of search results?

cmartell — Thu, 07 Apr 2016 14:59:57 GMT

No success yet. This is something Splunk needs to do. It is the International Standard Date Notation after all.

Re: How can I change the date format of search results?

jolous — Fri, 01 Mar 2019 08:34:31 GMT

Yes please!
I can not think of a single good reason why the date presentation format used by the GUI is not a user preference in the GUI.

Re: How can I change the date format of search results?

jolous — Tue, 29 Sep 2020 23:31:55 GMT

You need to force splunk to use a locale that has the date format you want.
In your case probably en_GB.

Quickfix: You can override the locale in the url - e.g. https://splunk/en-GB/app/search/...
Better fix: The default locale is specified by the browser - e.g. in prioritised order in chrome://settings/languages.
Your problem is probably that your actual preferred language is not supported by splunk, and the first one that in the list that splunk recognises is american english.
Add UK english and place it higher than american english and you should be OK.
Just make sure you remove any hardwired "en-US/" override from your URL.
Proper fix: I cannot think of a single reason why date presentation format should not be made a simple user preference, independently of available translation languages and having to know the obscure techicalities of which locale splunk will actually end up using.

The locales supported by splunk are de_DE, en_GB, en_US, fr_FR, it_IT, ja_JP, ko_KR, zh_CN, and zh_TW.
Source: https://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Userlanguageandlocale