Getting Data In

Changing Time Format

Path Finder


I have a search that displays the "UserID Expiration Date" field as "12/6/2019 21:01"

I would like to convert this to a format of the field "2019-12-6" (leaving out the time)

I appreciate all the help. This forum is awesome with awesome people.


Tags (2)
0 Karma

Super Champion

hey, try this.

index=your_base_search | rex field="UserID Expiration Date" "(?P<Date>[^\s]+)"

This will create Date field which will have the values which you want!

Let me know if this helps you!

0 Karma

Revered Legend

Try like this

your current search with field "UserID Expiration Date"
| eval "UserID Expiration Date"=strftime(strptime('UserID Expiration Date',"%m/%d/%Y %H:%M"),"%Y-%m-%d")


your current search with field "UserID Expiration Date"
| eval "UserID Expiration Date"=replace('UserID Expiration Date',"^(\d+)\/(\d+\/(\d+)(.+)","\3-\1-\2")
0 Karma


Run anywhere search that shows what you want:

| makeresults | eval expiration_original="12/6/2019 21:01" | eval expiration_new=strftime(strptime(expiration_original, "%m/%d/%Y %H:%M"), "%Y-%m-%d")

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...