Getting Data In

how to change the date format in splunk?


I have the date format like 2016-03-09 11:43:40.870 ( "%Y-%m-%d %H:%M:%S)

But i want to change the above date format like 03-09-2016 11:43:40.870 (%m-%d-%Y %H:%M:%S)

Thanks in advance

Tags (2)

Esteemed Legend

At search time you can do this:

| eval newDate=strftime(strptime(oldDate, "%Y-%m-%d %H:%M:%S"), "%m-%d-%Y %H:%M:%S")

or like this:

| rex mode=sed field=oldDate "s/(\d{4})-(\d+-\d+) /\2-\1 /"

At index time, like this:

SEDCMD-englishDateToUSA "s/(\d{4})-(\d+-\d+) /\2-\1 /"


Try this:

... | eval date=strftime(strptime(date,"%Y-%m-%d %H:%M:%S"), "%m-%d-%Y %H:%M:%S") | ...
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...