Splunk Enterprise

Field formatting

arunsoni
Explorer

Hi All,

I have a field which has improper format. I want to convert into a new field with proper format.

field name: Create

Value :  20190802212241Z

 

What I am looking is as below

New Field name : NewField

Value : 2019/08/02 21:22:41 

Thanks in advance!

Labels (1)
0 Karma

to4kawa
Ultra Champion

|eval NewField=strptime(Create,"%Y%m%d%H%M%S") |fieldformat NewField=strftime(NewField,"%Y/%m/%d %T")

0 Karma

isoutamo
SplunkTrust
SplunkTrust
If you want to keep timezone information with date and time then you must add also %Z to the end of formats.
R. Ismo
0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...