unable to convert string type date format to Date format.

[satishachary199]

My uploaded source having String type date format with different types like ('MAY-15' ,'May-2015','MAY-2015', 'May-15' ) want to covert all this to Date format like "MAY-2015" while searching for report.

Thanks in Adavance.

[niketn]

@satishachary1991 are you uploading this as lookup or indexing in Splunk? Can you add few sample events?

[cpetterborg]

In your specific case (as you describe the data above):

...| rex field=data mode=sed "s/([a-z]+)-20(\d+)/\\1-\\2/" 
| eval data=upper(data) 
| rex field=data mode=sed "s/-/-20/"

should give you a date like MAY-2015 in all these cases. It also assumes that the file data has MMM-YYYY or MMM-YY as the format.

[satishachary199]

yes the format is 'MMM-YY', thank you for solution, its working fine for 2015 only in my case not working with other year like 2016,2013,2014 , the result is coming ('APR-202012' , 'APR-202016', 'OCT-202013')
and still it's string type for that when applying "sort -data" its sorting alphabetically , can we able to make sort month wise and year wise by coverting date format?

[cpetterborg]

The change that needs to be made to the above was to include both upper and lower case in the regular expression. Here is a run-anywhere example that works for what you want.

| makeresults
| eval data="('MAY-15' ,'May-2015','MAY-2015', 'May-15' , 'may-2014', 'MaY-2016')"
| rex field=data mode=sed "s/([A-Za-z]+)-20(\d+)/\\1-\\2/g" 
| eval data=upper(data) 
| rex field=data mode=sed "s/-/-20/g"

[somesoni2]

Look at lower function available with eval to normalize the case of value of a field.

[satishachary199]

Hi somesoni , i tried with your answer , actually the probem i am facing with in my .csv file the filed represent MMM-YY format , when i am uploading in splunk and doing search i am not able to convert String type to date type. for that i am missing date functionality search. Could you help on this.