Hi, I'm pulling Tenable IO logs into Splunk and there is a field names first_found in regard to a vulnerability. The format is UNIX. I'd like to take that field data and create a new field and format it as $m/$d/$y at search time. I've scoured this site and reddit and can't get it to work.
Here is an example:
first_found = 2020-05-27T04:17:39.159Z
would like to create:
new_date = 5/27/2020
I've tried the below, but with no luck:
(search query) | convert timeformat="%m/%d/%y" ctime(first_found) AS new_date