Dashboards & Visualizations

Multiple time format in the same field

mah
Builder

Hi,

I have a field which contains epoch date and date time like %Y%m%d :

mah_0-1615469377850.png

I want this format %Y%m%d for all values in "date" field.

How can I convert epoch to date like %Y%m%d in this field ? 

Thanks !

 

Tags (1)
0 Karma
1 Solution

mah
Builder

Hi @manjunathmeti 

I tried your solution and it gave me this : 

mah_0-1615476507681.png

20210201 = 22-08-1970 : there is a problem ...

I tried another command : 

| convert timeformat="%Y-%m-%d" mktime("date")

and thant's worked ! All values in %Y-%m-%d format are converted to epoch time !

Thanks for your help !

View solution in original post

Tags (1)
0 Karma

manjunathmeti
Champion

hi @mah,
Try this:

| eval date=if(match(date, "\d{4}\-\d{2}\-\d{2}"), replace(date, "-", ""), strftime(date, "%Y%m%d"))

 

If this reply helps you, an upvote/like would be appreciated.

0 Karma

mah
Builder

Hi @manjunathmeti 

I tried your solution and it gave me this : 

mah_0-1615476507681.png

20210201 = 22-08-1970 : there is a problem ...

I tried another command : 

| convert timeformat="%Y-%m-%d" mktime("date")

and thant's worked ! All values in %Y-%m-%d format are converted to epoch time !

Thanks for your help !

Tags (1)
0 Karma

manjunathmeti
Champion

Did you wanted Date field values in "%Y%m%d" OR in epoch format?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...