Hi i have a Date in the below form
201304
201306
201307
I want to convert to these to below form
APR-13
JUN-13
JUL-13
Please help me in this
Thanking you
You can do that with a combination of strptime and strftime, see http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions for reference.
You can do that with a combination of strptime and strftime, see http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions for reference.
Try this:
... | eval newdate = upper(strftime(strptime(date+"01", "%Y%m%d"), "%b-%y"))
i tried to convert using above functions, but didn,t work.
Please help me .