Getting Data In

Converting Time and Date to a Uniform Value

ajdyer2000
Path Finder

Hi,
I have 3 data sources and all have different time and date formats.

Field1
2019-06-07 17:05:28.513
Field2
Tue, 06 Aug 2019 19:17:24 +0000
Field3
20190718140413.500000-240

I would like to have them all converted to mm/dd/yyyy hour minutes
Field1
06/07/2019 17:05
Field2
08/06/2019 19:47
Field3
07/18/2019 14:04

Thank you
Alan

0 Karma
1 Solution

jawaharas
Motivator

strptime and strftime are your friends for this problem.

| makeresults
| eval Field1="2019-06-07 17:05:28.513",Field2="Tue, 06 Aug 2019 19:17:24 +0000",Field3="20190718140413.500000-240"
| eval Date1=strftime(strptime(Field1, "%Y-%m-%d %H:%M"),"%m/%d/%Y %H:%M"), Date2=strftime(strptime(Field2, "%a, %d %b %Y %H:%M"),"%m/%d/%Y %H:%M"), Date3=strftime(strptime(Field3,"%Y%m%d%H%M"),"%m/%d/%Y %H:%M")

Reference:
https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Commontimeformatvariables

Can you upvote and accept the answer if it's helped you? Thanks.

View solution in original post

0 Karma

jawaharas
Motivator

strptime and strftime are your friends for this problem.

| makeresults
| eval Field1="2019-06-07 17:05:28.513",Field2="Tue, 06 Aug 2019 19:17:24 +0000",Field3="20190718140413.500000-240"
| eval Date1=strftime(strptime(Field1, "%Y-%m-%d %H:%M"),"%m/%d/%Y %H:%M"), Date2=strftime(strptime(Field2, "%a, %d %b %Y %H:%M"),"%m/%d/%Y %H:%M"), Date3=strftime(strptime(Field3,"%Y%m%d%H%M"),"%m/%d/%Y %H:%M")

Reference:
https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Commontimeformatvariables

Can you upvote and accept the answer if it's helped you? Thanks.

0 Karma

ajdyer2000
Path Finder

Awesome !!! Thank you so much!!!!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Do you want to do this at index time or search time?
To be clear, are these 3 data sources separate sourcetypes?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...