My uploaded source having String type date format with different types like ('MAY-15' ,'May-2015','MAY-2015', 'May-15' ) want to covert all this to Date format like "MAY-2015" while searching for report.
Thanks in Adavance.
@satishachary1991 are you uploading this as lookup or indexing in Splunk? Can you add few sample events?
In your specific case (as you describe the data above):
...| rex field=data mode=sed "s/([a-z]+)-20(\d+)/\\1-\\2/" | eval data=upper(data) | rex field=data mode=sed "s/-/-20/"
should give you a date like
MAY-2015 in all these cases. It also assumes that the file
MMM-YY as the format.
yes the format is 'MMM-YY', thank you for solution, its working fine for 2015 only in my case not working with other year like 2016,2013,2014 , the result is coming ('APR-202012' , 'APR-202016', 'OCT-202013')
and still it's string type for that when applying "sort -data" its sorting alphabetically , can we able to make sort month wise and year wise by coverting date format?
The change that needs to be made to the above was to include both upper and lower case in the regular expression. Here is a run-anywhere example that works for what you want.
| makeresults | eval data="('MAY-15' ,'May-2015','MAY-2015', 'May-15' , 'may-2014', 'MaY-2016')" | rex field=data mode=sed "s/([A-Za-z]+)-20(\d+)/\\1-\\2/g" | eval data=upper(data) | rex field=data mode=sed "s/-/-20/g"
Hi somesoni , i tried with your answer , actually the probem i am facing with in my .csv file the filed represent MMM-YY format , when i am uploading in splunk and doing search i am not able to convert String type to date type. for that i am missing date functionality search. Could you help on this.