topic Re: convert string date(without seprater) to readable date format - 20180112 to 12/01/2018 in Splunk Search

convert string date(without seprater) to readable date format - 20180112 to 12/01/2018

goyals05 — Tue, 23 Jan 2018 18:25:12 GMT

Hi,

I am using data-models. In raw data I am getting date as YYYYMMDD, I want to convert it in DD/MM/YYYY.

Is there a simple way to convert this as there is no separator ?

Otherwise I have to separate them in 3 different fields and use it.

 ^(?<year>\d\d\d\d)(?<month>\d\d)(?<day>\d\d)

Example : 20180112 to 12/01/2018
Thanks

Re: convert string date(without seprater) to readable date format - 20180112 to 12/01/2018

493669 — Tue, 23 Jan 2018 18:38:39 GMT

Try this anywhere search:

| makeresults
| eval Time="20180112"
| eval time=strftime(strptime(Time,"%Y%m%d"),"%d/%m/%Y")

You can create eval field expression in data model using | eval time=strftime(strptime(Time,"%Y%m%d"),"%d/%m/%Y")

Re: convert string date(without seprater) to readable date format - 20180112 to 12/01/2018

mayurr98 — Wed, 24 Jan 2018 09:21:33 GMT

Try this run anywhere search

| makeresults 
| eval date="20180112 20180130 20180131 20181212 20181231" 
| makemv date 
| mvexpand date 
| eval date=strftime(strptime(date,"%Y%m%d"),"%d/%m/%Y")

In your environment you should write,

<your_base_Search>
| eval date=strftime(strptime(date,"%Y%m%d"),"%d/%m/%Y")

The inner date is the field which have YYYYMMDD format.
let me know if this helps!

Re: convert string date(without seprater) to readable date format - 20180112 to 12/01/2018

mayurr98 — Wed, 24 Jan 2018 09:25:19 GMT

this will not work if you have Time="20180125" as the format is DD/MM/YYYY and not MM/DD/YYYY.

Re: convert string date(without seprater) to readable date format - 20180112 to 12/01/2018

493669 — Wed, 24 Jan 2018 09:40:11 GMT

Thanks for correction! ☺