Splunk Search

Convert date field given in dd(numeric)-mmm(text)-yyyy(numeric) into mm/dd/yyyy

vikfnu
Explorer

Hi
In one of my log reports a date field (not the deafult _time field) has data as 06-Mar-2018 and not as 03/06/2018.
Can anyone suggest a simple approach to do this conversion.
RIght now my thought process is as below:
| makeresults
| eval date = "17-Apr-2018"
|eval splitted=split(date, "-")
|table splitted| eval day = mvindex(splitted, 0)
| eval month_text = mvindex(splitted, 1)
| eval year = mvindex(splitted, 2)
| eval month=case( like(month_text,"Jan") OR like(month_text,"jan"),01, like(month_text,"Feb") OR like(month_text,"feb"),02,like(month_text,"Mar") OR like(month_text,"mar
"),03,like(month_text,"Apr") OR like(month_text,"apr"),04,like(month_text,"May") OR like(month_text,"may"),05,like(month_text,"Jun") OR like(month_text,"jun"),06,
like(month_text,"Jul") OR like(month_text,"jul"),07,like(month_text,"Aug") OR like(month_text,"aug"),08,like(month_text,"Sep") OR like(month_text,"sep"),09,
like(month_text,"Oct") OR like(month_text,"oct"),10,like(month_text,"Nov") OR like(month_text,"nov"),11,like(month_text,"Dec") OR like(month_text,"dec"),12)
|eval date_dt= +toString(month)+"/"+toString(day)+"/"+toString(year)| fields - splitted month_text

Please suggest

Tags (1)
0 Karma
1 Solution

adonio
Ultra Champion

hello there,

give this a shot:

  | makeresults 
    | eval date = "17-Apr-2018,18-Apr-2018,1-Jan-2018"
    | makemv delim="," date
    | mvexpand date
    | eval to_epoch = strptime(date, "%d-%b-%Y")
    | eval to_desired_format = strftime(to_epoch, "%m/%d/%Y")

hope it helps

View solution in original post

0 Karma

adonio
Ultra Champion

hello there,

give this a shot:

  | makeresults 
    | eval date = "17-Apr-2018,18-Apr-2018,1-Jan-2018"
    | makemv delim="," date
    | mvexpand date
    | eval to_epoch = strptime(date, "%d-%b-%Y")
    | eval to_desired_format = strftime(to_epoch, "%m/%d/%Y")

hope it helps

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...