How to turn string into date format?

[vishalduttauk]

I have a string of data and i've created regex to break down that set into different fields. There are date values within it (start_date and end_date) but format is ddmmyyy i.e. 2901012001.How can i convert it into DD-MM-YYYY so Splunk recognises it as a date or can be shown in that date format?

Ideally i'd like that to be down on ingestion. I have a props.conf and transforms.conf file for the app this sits in

[gcusello]

Hi @vishalduttauk,

sorry, it isn't clear what's your fields format: you said "ddmmyyy"  but the sample you used has 10 digits (2901012001), what's the correct one?

Anyway, you have to convert it in epochtime and then in the date format you like, something like this:

| your_date=strftime(strptime(yourfield,"%d%m%Y"),"%d-%m-%Y")

Ciao.

Giuseppe 

[vishalduttauk]

Hi @gcusello 

Thanks for your reply and sorry i pasted in the wrong information as an example but you are correct my message didn't have the correct format. it should have been 01021999.

Kind Regards,

Vishal

[gcusello · Accepted solution]

Hi @vishalduttauk,

this means the the original format is "ddmmyyyy" (with 4 digits for the year), can you confirm?

in this case you can use my eval statement:

| your_date=strftime(strptime(yourfield,"%d%m%Y"),"%d-%m-%Y")

Ciao.

giuseppe

[vishalduttauk]

Thanks @gcusello 

Its the first time i am using eval so it worked after i put in | eval

👍