Getting Data In

How do I convert the date format in a custom field?

egt
New Member

Hi,

I'm new here. I want to convert the format from "Thu Jan 31 23:01:13 CET 2019" to "31 Jan 2019" in a custom date field.

How can I do that?

0 Karma
1 Solution

Vijeta
Influencer

@egt If your time is in say variable x, then you need to use strptime to convert in time in seconds and then use strftime to convert it to format you need

eval y=strptime(x,"%a %b %d %H:%M:%S %Z %Y")|eval z= strftime(y,"%d %b %Y")

See the example created using makeresults.

|makeresults|eval x= "Thu Jan 31 23:01:13 CET 2019"| eval y=strptime(x,"%a %b %d %H:%M:%S %Z %Y")|eval z= strftime(y,"%d %b %Y")

View solution in original post

0 Karma

Vijeta
Influencer

@egt If your time is in say variable x, then you need to use strptime to convert in time in seconds and then use strftime to convert it to format you need

eval y=strptime(x,"%a %b %d %H:%M:%S %Z %Y")|eval z= strftime(y,"%d %b %Y")

See the example created using makeresults.

|makeresults|eval x= "Thu Jan 31 23:01:13 CET 2019"| eval y=strptime(x,"%a %b %d %H:%M:%S %Z %Y")|eval z= strftime(y,"%d %b %Y")
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this query:

... | eval time = strftime(strptime(existingTimeField, "%a %b %d %H:%M:%S %Z %Y"), "%d %b %Y") | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

vnravikumar
Champion

Hi @egt

Try like

| makeresults 
| eval date="Thu Jan 31 23:01:13 CET 2019" 
| eval epoch = strptime(date,"%a %b %d %H:%M:%S %Z %Y") 
| eval new_date =strftime(epoch,"%d %b %Y")
0 Karma

PowerPacked
Builder

Hi

Try this

| eval new_time = strftime(yourtimefield, "%d %b %Y")

0 Karma
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...