Dashboards & Visualizations

date format

owulz
Explorer

Hi I have two date fields that show up in my dash board panel that lists events after visualisation panels.

"2021-11-02 16:53:38" and "11/02/21 at 16:52:37"

I am trying to find a way to reformat the second date (right) to be like the first.

YYYY-MM-DD hh:mm:ss

Is there an easy way?

This is a search query inside a table listing.

Thank you

Labels (1)
0 Karma
1 Solution

manjunathmeti
Champion

hi @owulz,

Use strptime and strftime functions.

| eval seconddatetime=strftime(strptime(seconddatetime, "%d/%m/%y at %H:%M:%S"), "%Y-%d-%m %H:%M:%S")

 

If this reply helps you, an upvote/like would be appreciated.

View solution in original post

manjunathmeti
Champion

hi @owulz,

Use strptime and strftime functions.

| eval seconddatetime=strftime(strptime(seconddatetime, "%d/%m/%y at %H:%M:%S"), "%Y-%d-%m %H:%M:%S")

 

If this reply helps you, an upvote/like would be appreciated.

owulz
Explorer

Thanks so much @manjunathmeti !

0 Karma

manjunathmeti
Champion

You're welcome! You can accept the answer and give it a thumbs up.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...