hello I have a date 2024-06 how can i convert it to 06/2024?
and 2023/Q4 to Q4/2023
Is that a field in Splunk that is a string.
You can do this by swapping the characters around - for your first example
| eval date=replace(date, "(\d{4})-(\d{2})", "\2-\1")
and your second
| eval date=replace(date, "(\d{4})\/Q(\d)", "Q\2/\1")
where your data field is called date
Is that a field in Splunk that is a string.
You can do this by swapping the characters around - for your first example
| eval date=replace(date, "(\d{4})-(\d{2})", "\2-\1")
and your second
| eval date=replace(date, "(\d{4})\/Q(\d)", "Q\2/\1")
where your data field is called date