Getting Data In

Converting Time and Date to a Uniform Value

ajdyer2000
Path Finder

Hi,
I have 3 data sources and all have different time and date formats.

Field1
2019-06-07 17:05:28.513
Field2
Tue, 06 Aug 2019 19:17:24 +0000
Field3
20190718140413.500000-240

I would like to have them all converted to mm/dd/yyyy hour minutes
Field1
06/07/2019 17:05
Field2
08/06/2019 19:47
Field3
07/18/2019 14:04

Thank you
Alan

0 Karma
1 Solution

jawaharas
Motivator

strptime and strftime are your friends for this problem.

| makeresults
| eval Field1="2019-06-07 17:05:28.513",Field2="Tue, 06 Aug 2019 19:17:24 +0000",Field3="20190718140413.500000-240"
| eval Date1=strftime(strptime(Field1, "%Y-%m-%d %H:%M"),"%m/%d/%Y %H:%M"), Date2=strftime(strptime(Field2, "%a, %d %b %Y %H:%M"),"%m/%d/%Y %H:%M"), Date3=strftime(strptime(Field3,"%Y%m%d%H%M"),"%m/%d/%Y %H:%M")

Reference:
https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Commontimeformatvariables

Can you upvote and accept the answer if it's helped you? Thanks.

View solution in original post

0 Karma

jawaharas
Motivator

strptime and strftime are your friends for this problem.

| makeresults
| eval Field1="2019-06-07 17:05:28.513",Field2="Tue, 06 Aug 2019 19:17:24 +0000",Field3="20190718140413.500000-240"
| eval Date1=strftime(strptime(Field1, "%Y-%m-%d %H:%M"),"%m/%d/%Y %H:%M"), Date2=strftime(strptime(Field2, "%a, %d %b %Y %H:%M"),"%m/%d/%Y %H:%M"), Date3=strftime(strptime(Field3,"%Y%m%d%H%M"),"%m/%d/%Y %H:%M")

Reference:
https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Commontimeformatvariables

Can you upvote and accept the answer if it's helped you? Thanks.

0 Karma

ajdyer2000
Path Finder

Awesome !!! Thank you so much!!!!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Do you want to do this at index time or search time?
To be clear, are these 3 data sources separate sourcetypes?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Fall Into Learning with New Splunk Education Courses

Every month, Splunk Education releases new courses to help you branch out, strengthen your data science roots, ...

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...