how to change the date format in splunk?

[shankarananthth]

I have the date format like 2016-03-09 11:43:40.870 ( "%Y-%m-%d %H:%M:%S)

But i want to change the above date format like 03-09-2016 11:43:40.870 (%m-%d-%Y %H:%M:%S)

Thanks in advance

[woodcock]

At search time you can do this:

| eval newDate=strftime(strptime(oldDate, "%Y-%m-%d %H:%M:%S"), "%m-%d-%Y %H:%M:%S")

or like this:

| rex mode=sed field=oldDate "s/(\d{4})-(\d+-\d+) /\2-\1 /"

At index time, like this:

SEDCMD-englishDateToUSA "s/(\d{4})-(\d+-\d+) /\2-\1 /"

[richgalloway]

Try this:

... | eval date=strftime(strptime(date,"%Y-%m-%d %H:%M:%S"), "%m-%d-%Y %H:%M:%S") | ...