Reporting

Convert non-standard date field to $m/$d/$y at search time

asofo
Path Finder

Hi, I'm pulling Tenable IO logs into Splunk and there is a field names first_found in regard to a vulnerability. The format is UNIX. I'd like to take that field data and create a new field and format it as $m/$d/$y at search time. I've scoured this site and reddit and can't get it to work.

Here is an example:

first_found = 2020-05-27T04:17:39.159Z

would like to create:

new_date = 5/27/2020

I've tried the below, but with no luck:

(search query) | convert timeformat="%m/%d/%y" ctime(first_found) AS new_date

Any help would be appreciated.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

To convert a time string into a different format use strptime() to convert it into epoch form and strftime() to convert to the new string format.

| eval new_date = strftime(strptime(first_found, "%Y-%m-%dT%H:%M:%S.%3N%Z"),  %m/%d/%Y)
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...