Convert 210910085155 to yymmddhhmmss or dd/mm/yy hh:mm:ss

[peterk]

Hi 

Need help converting 210910085155 to yymmddhhmmss

index=mydata
| eval fields=split(EventMsg,",")
| eval file_string=mvindex(fields,0)
| eval CreatedDate=mvindex(fields,17)
| table CreatedDate

CreatedDate =210910085155 need to covert it to Date

[richgalloway]

Perhaps the easiest way is to use strptime/strftime.

index=mydata
| eval fields=split(EventMsg,",")
| eval file_string=mvindex(fields,0)
| eval CreatedDate=mvindex(fields,17)
| eval Date = strftime(strptime(CreatedDate, "%y%m%d%h%m%s"), "%d/%m/%y %H:%M:%S")

[Sharzi]

Try:

| eval Date=strftime(CreatedDate/1000, "%y%m%d%H%M%S")

or

| eval Date=strftime(CreatedDate/1000, "%d/%m/%y %H:%M:%S")

Also, you can use either %y or %Y for the year.