Getting Data In

Converting Time and Date to a Uniform Value

ajdyer2000
Path Finder

Hi,
I have 3 data sources and all have different time and date formats.

Field1
2019-06-07 17:05:28.513
Field2
Tue, 06 Aug 2019 19:17:24 +0000
Field3
20190718140413.500000-240

I would like to have them all converted to mm/dd/yyyy hour minutes
Field1
06/07/2019 17:05
Field2
08/06/2019 19:47
Field3
07/18/2019 14:04

Thank you
Alan

0 Karma
1 Solution

jawaharas
Motivator

strptime and strftime are your friends for this problem.

| makeresults
| eval Field1="2019-06-07 17:05:28.513",Field2="Tue, 06 Aug 2019 19:17:24 +0000",Field3="20190718140413.500000-240"
| eval Date1=strftime(strptime(Field1, "%Y-%m-%d %H:%M"),"%m/%d/%Y %H:%M"), Date2=strftime(strptime(Field2, "%a, %d %b %Y %H:%M"),"%m/%d/%Y %H:%M"), Date3=strftime(strptime(Field3,"%Y%m%d%H%M"),"%m/%d/%Y %H:%M")

Reference:
https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Commontimeformatvariables

Can you upvote and accept the answer if it's helped you? Thanks.

View solution in original post

0 Karma

jawaharas
Motivator

strptime and strftime are your friends for this problem.

| makeresults
| eval Field1="2019-06-07 17:05:28.513",Field2="Tue, 06 Aug 2019 19:17:24 +0000",Field3="20190718140413.500000-240"
| eval Date1=strftime(strptime(Field1, "%Y-%m-%d %H:%M"),"%m/%d/%Y %H:%M"), Date2=strftime(strptime(Field2, "%a, %d %b %Y %H:%M"),"%m/%d/%Y %H:%M"), Date3=strftime(strptime(Field3,"%Y%m%d%H%M"),"%m/%d/%Y %H:%M")

Reference:
https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Commontimeformatvariables

Can you upvote and accept the answer if it's helped you? Thanks.

0 Karma

ajdyer2000
Path Finder

Awesome !!! Thank you so much!!!!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Do you want to do this at index time or search time?
To be clear, are these 3 data sources separate sourcetypes?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...