Getting Data In

How to remove hh:mm:ss from a date/time field to be displayed in mm/dd/yyyy format?

New Member

So my original data looks like this:
AUDIT_CREATED_TS
7/17/2018 1:15:30 AM
7/17/2018 1:10:30 AM
7/17/2018 1:05:41 AM
:
:

But how do I change the data into this format via Splunk?
AUDIT_CREATED_TS
7/17/2018
7/17/2018
7/17/2018
:
:

Using this still does not help me:

...| convert timeformat="%m/%d-%Y" ctime(AUDIT_CREATED_TS) AS ctime

Doing this does not work too (AUDIT_CREATED_TS still in "%m/%d/%Y %H:%M:%S %AM/%PM" format, not %m/%d/%Y format I want)

... | eval AUDIT_CREATED_TS=strftime(AUDIT_CREATED_TS,"%m/%d/%Y")
0 Karma
1 Solution

SplunkTrust
SplunkTrust

A simple and fast (efficient) way is with rex:

... | rex mode=sed field=AUDIT_CREATED_TS "s/\s.*//"

It doesn't have to do any time calculations, just some simple string substitution.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

A simple and fast (efficient) way is with rex:

... | rex mode=sed field=AUDIT_CREATED_TS "s/\s.*//"

It doesn't have to do any time calculations, just some simple string substitution.

View solution in original post

0 Karma

New Member

This is super helpful, thanks 🙂

0 Karma

SplunkTrust
SplunkTrust

Your last eval was close, but AUDIT_CREATED_TS is already in text form so strftime won't work on it. You need to convert to epoch form and then to the desired text form. Try this.

... | eval AUDIT_CREATED_TS=strftime(strptime(AUDIT_CREATED_TS, "%m/%d/%Y %I:%M:%S %p"), "%m/%d/%Y")
---
If this reply helps you, an upvote would be appreciated.

New Member

Thanks! This really helped!

0 Karma

Path Finder

This has already been answered but you can also use the replace function.

| eval time=replace(AUDIT_CREATED_TS, ":","/")

This will replace the colons in that field with forward slashes and place the output into a field called time.

0 Karma

New Member

I accept your solution as well.

0 Karma