I have dates that look like "01/09/2014 00:00:00" that I want to chart. The dates take up too much real estate so I want to edit them so they are just:
01/09, 01/08, 01/07, etc.
One way is to use rex. Assuming field named time:
my search | rex field=time "(?P<time>\d+/\d+[^/]+)"
View solution in original post