topic Re: How do I write a search to change the format of a date from "1942-01-24" to "24/01/1942"? in Splunk Search

How do I write a search to change the format of a date from "1942-01-24" to "24/01/1942"?

IRHM73 — Fri, 02 Oct 2015 08:54:52 GMT

Hi,

I wonder whether someone may be able to help me please.

I have a date in one of my searches which is in this format: 1942-01-24

Could someone tell me please if is it possible to change this to: 24/01/1942

Many thanks and kind Regards

Chris

Re: How do I write a search to change the format of a date from "1942-01-24" to "24/01/1942"?

HiroshiSatoh — Fri, 02 Oct 2015 09:37:09 GMT

What with this?

・・・・|eval a="2015-10-02"|eval b=strftime(strptime(a,"%Y-%m-%d"),"%d/%m/%Y")|eval c=substr(a,9,2)+"/"+substr(a,6,2)+"/"+substr(a,1,4)|table a b c

However, use the C because that can not be calculated in 1942.

Re: How do I write a search to change the format of a date from "1942-01-24" to "24/01/1942"?

IRHM73 — Fri, 02 Oct 2015 09:42:02 GMT

Hi, thank you for this.

I changed the date you entered to my field name to get the raw data and I've included a, b and c in my table but unfortunately this doesn't return any data.

Is it also possible that the output could be displayed in one field rather than a, b and c.

Many thanks and kind regards

Chris

Re: How do I write a search to change the format of a date from "1942-01-24" to "24/01/1942"?

HiroshiSatoh — Fri, 02 Oct 2015 09:49:36 GMT

Normally I think it is correct to convert using the strptime.
However, the date of the previous 1970 this function does not seem to work.

Re: How do I write a search to change the format of a date from "1942-01-24" to "24/01/1942"?

knielsen — Fri, 02 Oct 2015 10:08:44 GMT

Another way of converting would be:

| stats count | eval date="1942-01-24" | eval date=replace(date,"(\d+)-(\d+)-(\d+)","\3/\2/\1") | table date

Hth,
Kai.

Re: How do I write a search to change the format of a date from "1942-01-24" to "24/01/1942"?

IRHM73 — Fri, 02 Oct 2015 11:08:06 GMT

Many thanks, hopefully someone else may be able to look at this.

Kind regards

Chris

Re: How do I write a search to change the format of a date from "1942-01-24" to "24/01/1942"?

woodcock — Sun, 04 Oct 2015 17:19:56 GMT

Like this:

 | stats count | eval date="1942-01-24" | rex mode=sed field=date "s/(\d+)-(\d+)-(\d+)/\3\/\2\/\1/" | table date

Re: How do I write a search to change the format of a date from "1942-01-24" to "24/01/1942"?

IRHM73 — Mon, 05 Oct 2015 05:59:26 GMT

Hi @kai, thank you for taking the time to reply to my post.

This works perfectly.

Many thanks and kindest regards

Chris

Re: How do I write a search to change the format of a date from "1942-01-24" to "24/01/1942"?

IRHM73 — Mon, 05 Oct 2015 06:02:20 GMT

Hi @woodcock, thank you for taking the time to reply to my post. Your solution works great.

Many thanks and kind regards

Chris