Dashboards & Visualizations

Multiple time format in the same field

mah
Builder

Hi,

I have a field which contains epoch date and date time like %Y%m%d :

mah_0-1615469377850.png

I want this format %Y%m%d for all values in "date" field.

How can I convert epoch to date like %Y%m%d in this field ? 

Thanks !

 

Tags (1)
0 Karma
1 Solution

mah
Builder

Hi @manjunathmeti 

I tried your solution and it gave me this : 

mah_0-1615476507681.png

20210201 = 22-08-1970 : there is a problem ...

I tried another command : 

| convert timeformat="%Y-%m-%d" mktime("date")

and thant's worked ! All values in %Y-%m-%d format are converted to epoch time !

Thanks for your help !

View solution in original post

Tags (1)
0 Karma

manjunathmeti
Champion

hi @mah,
Try this:

| eval date=if(match(date, "\d{4}\-\d{2}\-\d{2}"), replace(date, "-", ""), strftime(date, "%Y%m%d"))

 

If this reply helps you, an upvote/like would be appreciated.

0 Karma

mah
Builder

Hi @manjunathmeti 

I tried your solution and it gave me this : 

mah_0-1615476507681.png

20210201 = 22-08-1970 : there is a problem ...

I tried another command : 

| convert timeformat="%Y-%m-%d" mktime("date")

and thant's worked ! All values in %Y-%m-%d format are converted to epoch time !

Thanks for your help !

Tags (1)
0 Karma

manjunathmeti
Champion

Did you wanted Date field values in "%Y%m%d" OR in epoch format?

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...