Splunk Search

Help to convert date using strftime

Marco_Develops
Path Finder

Currently I have a field holding a Julian date. I am trying to convert it using strftime but i'm having issues.

 

Date = 2022.091

Current query:

 

 

index = * | eval ConvertedDate = strftime(DATE,"%Y.%j")| table ConvertedDate

 

 

 

Ideally I would like to get an output like 04/03/2022

 

Thank you,

Marco

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The strftime function converts an epoch timestamp (integer) into a human-readable string.  Use the strptime function to convert a datetime string into epoch form.

 

index = * 
| eval ConvertedDate = strftime(strptime(DATE,"%Y.%j"), "%m/%d/%Y")
| table ConvertedDate

 

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The strftime function converts an epoch timestamp (integer) into a human-readable string.  Use the strptime function to convert a datetime string into epoch form.

 

index = * 
| eval ConvertedDate = strftime(strptime(DATE,"%Y.%j"), "%m/%d/%Y")
| table ConvertedDate

 

 

---
If this reply helps you, Karma would be appreciated.

Marco_Develops
Path Finder

@richgalloway This worked. Thank you for your time and explanation . 

-Marco

0 Karma
Get Updates on the Splunk Community!

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...

Data Management Digest – January 2026

Welcome to the January 2026 edition of Data Management Digest! Welcome to the January 2026 edition of Data ...

Splunk SOAR Now Available on Google Cloud Platform

We’re excited to announce that Splunk SOAR is now natively available as a SaaS solution on Google Cloud ...