Splunk Search

Date Format in required form

ncbshiva
Communicator

Hi i have a Date in the below form

201304
201306
201307

I want to convert to these to below form

APR-13
JUN-13
JUL-13

Please help me in this

Thanking you

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can do that with a combination of strptime and strftime, see http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions for reference.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can do that with a combination of strptime and strftime, see http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions for reference.

martin_mueller
SplunkTrust
SplunkTrust

Try this:

... | eval newdate = upper(strftime(strptime(date+"01", "%Y%m%d"), "%b-%y"))
0 Karma

ncbshiva
Communicator

i tried to convert using above functions, but didn,t work.
Please help me .

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...