How to convert a date field into human readable?

[coldwolf7]

Hello,

I have field that is called Bootuptime it is displayed like 20230521050657.500000-300

it is not string field and I have used a command like | eval Boot=strptime(Bootuptime, "%Y-%m-%d %H:%M:S"). Which returns nothing or converts it to UNIX. Which does work

If you look at the result the part I care about is 20230521050657 which Need to display like 

2023-05-21 05:06:57, 

there is no converting of numbers, I just need to add the appropriate dashes and colons and remove the part after the period.

Any help is appreciated

Thanks

[coldwolf7]

| eval Bootuptime = strftime(strptime(Bootuptime, "%Y%m%d%H%M%S%Z"), "%Y-%m-%d %H:%M:%S")

Once I remove the %Z it work perfect. Thanks

[richgalloway · Accepted solution]

The field already is in human-readable format, just not a *good* format.  The process of converting timestamps from one text format to another is to first convert it into "Unix" format and then convert it to the new text format.

You had the right idea by using strptime, but needed to use the right format string.

| eval Bootuptime = strptime(Bootuptime, "%Y%m%d%H%M%S%Z")
| eval Bootuptime = strftime(Bootuptime, "%Y-%m-%d %H:%M:%S")

or combine them into a single statement:

| eval Bootuptime = strftime(strptime(Bootuptime, "%Y%m%d%H%M%S%Z"), "%Y-%m-%d %H:%M:%S")