Getting Data In

How to convert the MongoDB ISO date to Normal date format in HUnk

Path Finder

Can you please share How to convert mongodb ISO date into Normal date format in Hunk . I am getting the date format as "1426185748" but i want the output format as "YYYY-MM-DD"

Thanks in advance

Splunk Employee
Splunk Employee

In my case I added the format = date to the indexes.conf file under /hunk/etc/apps/search/local
That flag will extract ISODate and you should be able to see a JSON format and _timestamp field in the Hunk UI
For example,
vix.mongodb.collection = movieratings
vix.mongodb.db = raanan
vix.mongodb.field.time = ts
vix.mongodb.field.time.format = date
vix.provider = local-mongodb

After the extraction you can also add more flags in the props.conf. For example, in my case I also have
MAX_DAYS_AGO = 123456789
TIME_PREFIX = _timestamp" :

0 Karma

Splunk Employee
Splunk Employee

Can you share your indexes.conf file that includes all the configurations?
There is no props.conf out of the box. You will need to create it.

Look for an example props.conf In this thread

In my example, ts is the field + date is the format:
{ "_id" : ObjectId("5388e41c12569b70c376e9fb"), "userid" : 1, "movieid" : 122, "ts" : ISODate("1996-08-02T11:24:06Z"), "rating" : 5 }
{ "_id" : ObjectId("5388e41c12569b70c376e9fc"), "userid" : 1, "movieid" : 185, "ts" : ISODate("1996-08-02T10:58:45Z"), "rating" : 5 }

0 Karma

Path Finder

Hi rdagan_splunk,

Thanks for giving me the reply

i given all the settings in the MongoDB Virtual index but still i am facing the same and also i have searched the prop.conf file contains Mongo DB Collection name but i didn't find the prop.conf file. Can u please share me the Path of that prop.conf (which contains the Mongo DB collection information)

Thanks in Advance

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!