Getting Data In

how to change the date format in splunk?

shankarananthth
Explorer

I have the date format like 2016-03-09 11:43:40.870 ( "%Y-%m-%d %H:%M:%S)

But i want to change the above date format like 03-09-2016 11:43:40.870 (%m-%d-%Y %H:%M:%S)

Thanks in advance

Tags (2)

woodcock
Esteemed Legend

At search time you can do this:

| eval newDate=strftime(strptime(oldDate, "%Y-%m-%d %H:%M:%S"), "%m-%d-%Y %H:%M:%S")

or like this:

| rex mode=sed field=oldDate "s/(\d{4})-(\d+-\d+) /\2-\1 /"

At index time, like this:

SEDCMD-englishDateToUSA "s/(\d{4})-(\d+-\d+) /\2-\1 /"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this:

... | eval date=strftime(strptime(date,"%Y-%m-%d %H:%M:%S"), "%m-%d-%Y %H:%M:%S") | ...
---
If this reply helps you, an upvote would be appreciated.
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>