How to remove hh:mm:ss from a date/time field to be displayed in mm/dd/yyyy format?

[dennisSplunk201]

So my original data looks like this:
AUDIT_CREATED_TS
7/17/2018 1:15:30 AM
7/17/2018 1:10:30 AM
7/17/2018 1:05:41 AM
:
:
But how do I change the data into this format via Splunk?
AUDIT_CREATED_TS
7/17/2018
7/17/2018
7/17/2018
:
:

Using this still does not help me:

...| convert timeformat="%m/%d-%Y" ctime(AUDIT_CREATED_TS) AS ctime

Doing this does not work too (AUDIT_CREATED_TS still in "%m/%d/%Y %H:%M:%S %AM/%PM" format, not %m/%d/%Y format I want)

... | eval AUDIT_CREATED_TS=strftime(AUDIT_CREATED_TS,"%m/%d/%Y")

[cpetterborg · Accepted solution]

A simple and fast (efficient) way is with rex:

... | rex mode=sed field=AUDIT_CREATED_TS "s/\s.*//"

It doesn't have to do any time calculations, just some simple string substitution.

[dennisSplunk201]

This is super helpful, thanks 🙂

[richgalloway]

Your last eval was close, but AUDIT_CREATED_TS is already in text form so strftime won't work on it. You need to convert to epoch form and then to the desired text form. Try this.

... | eval AUDIT_CREATED_TS=strftime(strptime(AUDIT_CREATED_TS, "%m/%d/%Y %I:%M:%S %p"), "%m/%d/%Y")

[dennisSplunk201]

Thanks! This really helped!

[auraria1]

This has already been answered but you can also use the replace function.

| eval time=replace(AUDIT_CREATED_TS, ":","/")

This will replace the colons in that field with forward slashes and place the output into a field called time.

[dennisSplunk201]

I accept your solution as well.