Getting Data In

Changing Time Format

ajdyer2000
Path Finder

Hi,

I have a search that displays the "UserID Expiration Date" field as "12/6/2019 21:01"

I would like to convert this to a format of the field "2019-12-6" (leaving out the time)

I appreciate all the help. This forum is awesome with awesome people.

Alan

Tags (2)
0 Karma

mayurr98
Super Champion

hey, try this.

index=your_base_search | rex field="UserID Expiration Date" "(?P<Date>[^\s]+)"

This will create Date field which will have the values which you want!

Let me know if this helps you!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

your current search with field "UserID Expiration Date"
| eval "UserID Expiration Date"=strftime(strptime('UserID Expiration Date',"%m/%d/%Y %H:%M"),"%Y-%m-%d")

OR

your current search with field "UserID Expiration Date"
| eval "UserID Expiration Date"=replace('UserID Expiration Date',"^(\d+)\/(\d+\/(\d+)(.+)","\3-\1-\2")
0 Karma

micahkemp
Champion

Run anywhere search that shows what you want:

| makeresults | eval expiration_original="12/6/2019 21:01" | eval expiration_new=strftime(strptime(expiration_original, "%m/%d/%Y %H:%M"), "%Y-%m-%d")

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...