Convert non-standard date field to $m/$d/$y at search time

[asofo]

Hi, I'm pulling Tenable IO logs into Splunk and there is a field names first_found in regard to a vulnerability. The format is UNIX. I'd like to take that field data and create a new field and format it as $m/$d/$y at search time. I've scoured this site and reddit and can't get it to work.

Here is an example:

first_found = 2020-05-27T04:17:39.159Z

would like to create:

new_date = 5/27/2020

I've tried the below, but with no luck:

(search query) | convert timeformat="%m/%d/%y" ctime(first_found) AS new_date

Any help would be appreciated.

[richgalloway]

To convert a time string into a different format use strptime() to convert it into epoch form and strftime() to convert to the new string format.

| eval new_date = strftime(strptime(first_found, "%Y-%m-%dT%H:%M:%S.%3N%Z"),  %m/%d/%Y)