How do I convert the date format in a custom field?

[egt]

Hi,

I'm new here. I want to convert the format from "Thu Jan 31 23:01:13 CET 2019" to "31 Jan 2019" in a custom date field.

How can I do that?

[Vijeta · Accepted solution]

@egt If your time is in say variable x, then you need to use strptime to convert in time in seconds and then use strftime to convert it to format you need

eval y=strptime(x,"%a %b %d %H:%M:%S %Z %Y")|eval z= strftime(y,"%d %b %Y")

See the example created using makeresults.

|makeresults|eval x= "Thu Jan 31 23:01:13 CET 2019"| eval y=strptime(x,"%a %b %d %H:%M:%S %Z %Y")|eval z= strftime(y,"%d %b %Y")

[richgalloway]

Try this query:

... | eval time = strftime(strptime(existingTimeField, "%a %b %d %H:%M:%S %Z %Y"), "%d %b %Y") | ...

[vnravikumar]

Hi @egt

Try like

| makeresults 
| eval date="Thu Jan 31 23:01:13 CET 2019" 
| eval epoch = strptime(date,"%a %b %d %H:%M:%S %Z %Y") 
| eval new_date =strftime(epoch,"%d %b %Y")

[PowerPacked]

Hi

Try this

| eval new_time = strftime(yourtimefield, "%d %b %Y")