Getting Data In

Converting Time and Date to a Uniform Value

ajdyer2000
Path Finder

Hi,
I have 3 data sources and all have different time and date formats.

Field1
2019-06-07 17:05:28.513
Field2
Tue, 06 Aug 2019 19:17:24 +0000
Field3
20190718140413.500000-240

I would like to have them all converted to mm/dd/yyyy hour minutes
Field1
06/07/2019 17:05
Field2
08/06/2019 19:47
Field3
07/18/2019 14:04

Thank you
Alan

0 Karma
1 Solution

jawaharas
Motivator

strptime and strftime are your friends for this problem.

| makeresults
| eval Field1="2019-06-07 17:05:28.513",Field2="Tue, 06 Aug 2019 19:17:24 +0000",Field3="20190718140413.500000-240"
| eval Date1=strftime(strptime(Field1, "%Y-%m-%d %H:%M"),"%m/%d/%Y %H:%M"), Date2=strftime(strptime(Field2, "%a, %d %b %Y %H:%M"),"%m/%d/%Y %H:%M"), Date3=strftime(strptime(Field3,"%Y%m%d%H%M"),"%m/%d/%Y %H:%M")

Reference:
https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Commontimeformatvariables

Can you upvote and accept the answer if it's helped you? Thanks.

View solution in original post

0 Karma

jawaharas
Motivator

strptime and strftime are your friends for this problem.

| makeresults
| eval Field1="2019-06-07 17:05:28.513",Field2="Tue, 06 Aug 2019 19:17:24 +0000",Field3="20190718140413.500000-240"
| eval Date1=strftime(strptime(Field1, "%Y-%m-%d %H:%M"),"%m/%d/%Y %H:%M"), Date2=strftime(strptime(Field2, "%a, %d %b %Y %H:%M"),"%m/%d/%Y %H:%M"), Date3=strftime(strptime(Field3,"%Y%m%d%H%M"),"%m/%d/%Y %H:%M")

Reference:
https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Commontimeformatvariables

Can you upvote and accept the answer if it's helped you? Thanks.

0 Karma

ajdyer2000
Path Finder

Awesome !!! Thank you so much!!!!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Do you want to do this at index time or search time?
To be clear, are these 3 data sources separate sourcetypes?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...