Having a bit of an issue understanding how to apply this to change the date/time format of a field from a lookup table. The issue I am having is that when sorting by "Completion Date" the dates do not sort correct because of the format. For example Jan/7/2019 will show higher than Jan/17/2019. So the idea was to convert the timestamp to include a 0 (Jan/07/2019) so it sorts properly. Any help is appreciated.
It works in testing as per below, I can't get it to apply to my query:
If you have field names with spaces in them, you need to quote the fields! Or replace the name with underscores, just as you did. And yes, in this special case, Splunk will have difficulties recognizing the former as a variable and the latter as a string.
Thats why it is always a good practice to go with non-space field names, and do the conversion (remaming) at the very end!