Splunk Search

Date Format

JoeSco27
Communicator

I have a field called DATE and it is returning values yyyy-mm-dd HH:MM:SS. I am trying to chop off the hours, min, seconds so I only have yyyy-mm-dd. I have tried to use the convert command but I would rather not have to convert it to epoch time and then convert it back. Is there an easier way to go about this?

Thank you in advance

Tags (2)
0 Karma

asimagu
Builder

the most efficient way is to set up TIME_FORMAT in props.conf . That will do the magic at indexing time

0 Karma

JoeSco27
Communicator

| eval n=strptime(DATE, "%Y-%m-%d") | convert timeformat="%Y %m %d" ctime(n) AS c_time | chart count by c_time

this gave me the count for each day i requested, thank you for the help

0 Karma

JSapienza
Contributor

If Splunk is not already parsing out this field , you can use something like such:

...|rex field=DATE mode=sed "/s/\d{2}:\d{2}:\d{2}//g"
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...