 
					
				
		
Hi Guys,
I am trying to create a use-case as " date when any single user was created in AD" it's done but I need to change time format to readable format, right now it coming like this "20170905133223.0Z" how can I convert it to as " 05-September-2017" I tried with eval command as follows but no effect in results.
search:| ldapsearch domain=default search="(objectClass=user)" | table displayName,whenCreated |eval epochtime=strptime(whenCreated, "%Y %m %d %H:%M:%S") | eval desired_time=strftime(epochtime, "%d/%m/%Y")
result: ABC|20170905133223.0Z
desired result: ABC|05-September-2017
 
		
		
		
		
		
	
			
		
		
			
					
		Please check - 
search:| ldapsearch domain=default search="(objectClass=user)" |eval epochtime=strptime(whenCreated, "%Y%m%d%H%M%S.%1N%Z") | eval desired_time=strftime(epochtime, "%d/%m/%Y") |  table displayName whenCreated desired_time
 
		
		
		
		
		
	
			
		
		
			
					
		Please check - 
search:| ldapsearch domain=default search="(objectClass=user)" |eval epochtime=strptime(whenCreated, "%Y%m%d%H%M%S.%1N%Z") | eval desired_time=strftime(epochtime, "%d/%m/%Y") |  table displayName whenCreated desired_time
 
					
				
		
Yes! it's working thank you
 
					
				
		
 
		
		
		
		
		
	
			
		
		
			
					
		HI abid91,
try something like this
| ldapsearch domain=default search="(objectClass=user)" 
| eval whenCreated=strftime(strptime(whenCreated, "%Y %m %d %H:%M:%S"), "%d/%m/%Y")
| table displayName,whenCreated 
Check the original time format of whenCreated
Bye.
Giuseppe
 
					
				
		
its showing blank values in whenCreated filed.
