https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-month-from-date-field-in-string/m-p/316665#M94749 <P>I have a date field in a string with the format as mn/day/year. I need to extract the month from the same. Can someone help on this issue?</P> Wed, 24 May 2017 16:33:24 GMT srinadh 2017-05-24T16:33:24Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-month-from-date-field-in-string/m-p/316665#M94749 <P>I have a date field in a string with the format as mn/day/year. I need to extract the month from the same. Can someone help on this issue?</P> Wed, 24 May 2017 16:33:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-month-from-date-field-in-string/m-p/316665#M94749 srinadh 2017-05-24T16:33:24Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-month-from-date-field-in-string/m-p/316666#M94750 <P>Like this:</P> <PRE><CODE>... | rex field=YourFieldHere "(^?&lt;Month&gt;[^\/]+)" </CODE></PRE> Wed, 24 May 2017 16:56:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-month-from-date-field-in-string/m-p/316666#M94750 woodcock 2017-05-24T16:56:48Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-month-from-date-field-in-string/m-p/316667#M94751 <P>The best way I have found to do this is convert field to epoch time, then just pull the month out of that. For example:</P> <P>| eval epochField=strptime(field, "%m/%d/%Y")<BR /> | eval month=strftime(epochField, "%B")</P> <P>The syntax will vary somewhat based on the exact format of the date and the exact format you want the month in. Refer to this document: <A href="http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Commontimeformatvariables">http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Commontimeformatvariables</A></P> Wed, 24 May 2017 17:13:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-month-from-date-field-in-string/m-p/316667#M94751 chrishartsock 2017-05-24T17:13:57Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-month-from-date-field-in-string/m-p/316668#M94752 <P>you can combine them into one eval, as well. </P> <PRE><CODE>| eval month=strftime(strptime(field, "%m/%d/%y"), "%B") </CODE></PRE> Wed, 24 May 2017 17:42:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-month-from-date-field-in-string/m-p/316668#M94752 cmerriman 2017-05-24T17:42:18Z