Hi
Need help converting 210910085155 to yymmddhhmmss
index=mydata
| eval fields=split(EventMsg,",")
| eval file_string=mvindex(fields,0)
| eval CreatedDate=mvindex(fields,17)
| table CreatedDate
CreatedDate =210910085155 need to covert it to Date
Perhaps the easiest way is to use strptime/strftime.
index=mydata
| eval fields=split(EventMsg,",")
| eval file_string=mvindex(fields,0)
| eval CreatedDate=mvindex(fields,17)
| eval Date = strftime(strptime(CreatedDate, "%y%m%d%h%m%s"), "%d/%m/%y %H:%M:%S")
Try:
| eval Date=strftime(CreatedDate/1000, "%y%m%d%H%M%S")
or
| eval Date=strftime(CreatedDate/1000, "%d/%m/%y %H:%M:%S")
Also, you can use either %y or %Y for the year.